Getting Data In

REST /services/data/indexes gives me the wrong numbers. How do I fix that?

asturt
Explorer

I have a report running the following search:

| REST /services/data/indexes | WHERE substr(title,1,1)!="_" | dedup title |table title totalEventCount currentDBSizeMB minTime maxTime |sort -totalEventCount -currentDBSizeMB title

Last Friday we upgraded to the most recent version of Splunk, and two days ago our admin team added storage on two Index servers. Now all but two of my indexes report as having only a single event in them. In fact, both totalEventCount and currentDBSizeMB return a value of 1 for all but two indexes. Even on the two indexes that do return higher counts, the numbers are MUCH lower than they should be. I don't know if the Splunk version upgrade or the addition of storage caused my counts to change. They may be completely unrelated.

My question is how can I fix the counts coming from the REST service?

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...