Solved: index event count - Splunk Community

Splunk Search

How can I get the total number of events occurred in a particular day for all my indexes?

1 Solution

Solution

Like this :

index=_internal sourcetype=splunkd group=per_index_thruput | stats sum(ev) as events by series | rename series as index

View solution in original post

Solution

Like this :

index=_internal sourcetype=splunkd group=per_index_thruput | stats sum(ev) as events by series | rename series as index

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...