eventcount
eventcount
Synopsis
Returns the number of events in an index.
Syntax
eventcount [index=<string>] [summarize=<bool>] [report_size=<bool>]
Optional arguments
- index
- Syntax: index=<string>
- Description: The name of the index to count events, instead of the default index.
- report_size
- Syntax: report_size=<bool>
- Description: Show the index size in bytes. Defaults to False.
- summarize
- Syntax: summarize=<bool>
- Description: Specifies whether or not to summarize eventcounts.
Examples
Example 1: Gives event count by each index/server pair.
| eventcount summarize=false index=*Example 2: Displays event count over all search peers.
| eventcount summarize=trueExample 3: Return the number of events in the '_internal' index.
| eventcount index=_internalAnswers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the eventcount command.
This documentation applies to the following versions of Splunk: 4.1 , 4.1.1 , 4.1.2 , 4.1.3 , 4.1.4 , 4.1.5 , 4.1.6 , 4.1.7 , 4.1.8 , 4.2 , 4.2.1 , 4.2.2 , 4.2.3 , 4.2.4 , 4.2.5 , 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 , 5.0 , 5.0.1 , 5.0.2 View the Article History for its revisions.