Search Reference

 


eventcount

NOTE - Splunk version 4.x reached its End of Life on October 1, 2013. Please see the migration information.

eventcount

Synopsis

Returns the number of events in a specified index(es).

Syntax

eventcount [index=<string>] [summarize=<bool>] [report_size=<bool>]

Optional arguments

index
Syntax: index=<string>
Description: The name of the index to count events, instead of the default index.
report_size
Syntax: report_size=<bool>
Description: If True, report the index size in bytes. Defaults to False.
summarize
Syntax: summarize=<bool>
Description: Specifies whether or not to summarize events across all peers and indexes. If False, it splits the event count by index and search peer. Defaults to True.

Examples

Example 1: Displays event count in the default indexes over all search peers.

| eventcount

Example 2: Return the number of events in the '_internal' index only.

| eventcount index=_internal

Example 3: Gives event count by each index/server pair.

| eventcount summarize=false index=*

Searchref eventcount ex1.1.png

If you want to search for the internal indexes, you have to specify them:

| eventcount summarize=false index=_*

Searchref eventcount ex1.2.png

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the eventcount command.

This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 , 5.0.3 , 5.0.4 , 5.0.5 , 5.0.6 , 5.0.7 , 5.0.8 , 5.0.9 , 6.0 , 6.0.1 , 6.0.2 , 6.0.3 , 6.0.4 , 6.0.5 , 6.1 , 6.1.1 , 6.1.2 View the Article History for its revisions.


You must be logged into splunk.com in order to post comments. Log in now.

Was this documentation topic helpful?

If you'd like to hear back from us, please provide your email address:

We'd love to hear what you think about this topic or the documentation as a whole. Feedback you enter here will be delivered to the documentation team.

Feedback submitted, thanks!