totalCount in |metadata command: current number of events or lifetime count of events?

[Jason]

Is the number of events reported as totalCount in | metadata...

• the lifetime running total of the events for that (source|sourcetype|host), so the number only goes up

... or ...

• the current total, so the number could go up and down once buckets start rolling out of indexes?

[rshoward]

UPDATE: It is a total indexed over lifetime counter. I ran the trend on a huge data set that has a full index that is cycling out old events. For the last week the totalCount for all assets have only been increasing. The numbers also differ in the billions from the index stats when added up.

----original----

My initial test shows it is the "current total" you speak of; meaning it could go up and down. I'm running another test now with a larger set of data then I'll let you know once I ingest more from another host which should reduce the value of totalCount when the limit is hit. (I have a trend running on that value per host so it should dip once I complete these bulk tests)

[rshoward]

Jason, sorry for the delay. I let the trend run for a week just to be sure. I've update the answer with my findings.

[Jason]

Thanks. Do you have a result from that larger data set?