That field is populated by summing the counts of events for each sourcetype as found in the metadata.
This number would decrease if some buckets rolled to frozen or anyone deleted data from search language.
Most likely, this is because a Splunk index bucket was rolled from cold to frozen (and possibly deleted, depending on your configuration). As buckets age, they move from hot to warm to cold to frozen. The default action for moving to frozen is to delete the bucket. Your "events indexed" counter would then be reduced by the number of events in that bucket.
The docs cover this well at http://www.splunk.com/base/Documentation/4.2.1/Admin/HowSplunkstoresindexes
That field is populated by summing the counts of events for each sourcetype as found in the metadata.
This number would decrease if some buckets rolled to frozen or anyone deleted data from search language.
Thanks bwooden, looks like the maxTotalDataSizeMB was set and some data rolled over to frozen.