ABOUT OF NUMBER OF EVENTS INDEXED

[ssv24]

AFTER going through the fundamentals of splunk 1 course, I installed splunk and uploaded all the 3 data sets into splunk. But then i checked the the count of events indexed before logging out as it is instructruted in the pdf from the course. And later i logged out and logged in again. Then saw a different count of the events indexed. Why like that? Can anyone please explain....

[woodcock]

Probably you were using a Time picker value like Last 4 hours which gradually shifts events beyond the matching timeframe as time marches forward but then you logged in again and selected a different longer value like All time which covered all the events regardless of how old they are.

[woodcock]

Events do not stay forever; depending on the settings in indexes.conf and the amount of disk space available, the events will be automatically deleted.

[ssv24]

yeah. Ok but the count increased after logging out and logging in again. Why?