Splunk Search

How to search Splunk indexes' event count for the last one hour including zero counts?

dhavamanis
Builder

Can you please tell us how to check Splunk indexes' event count for last one hour including zero counts? For a specific index, the search below works fine. If we want results for multiple indexes, how do we write the search?

Search working fine with one index and zero count

index="idx1" earliest=-1h | stats count  | where count=0 

Search not working with multiple indexes to include zero count:

index="idx1" OR index="idx2" OR "idx3" earliest=-1h | stats count by index | where count=0 

Need a output like:

index count
------------
idx1    0
idx3    0
Tags (3)
1 Solution

HiroshiSatoh
Champion

The What about with this?

index="idx*" earliest=-1h | stats count by index |
append [| eventcount summarize=false index="idx*"|stats count by index|eval count=0|table index,count]|
stats sum(count) as count by index
| where count=0

View solution in original post

HiroshiSatoh
Champion

The What about with this?

index="idx*" earliest=-1h | stats count by index |
append [| eventcount summarize=false index="idx*"|stats count by index|eval count=0|table index,count]|
stats sum(count) as count by index
| where count=0
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...