I'm trying to obtain the total number of events stored in an index. However, using 2 REST endpoints give me two different results. Would anyone know why the difference and which number we should trust?
indexes-extended data is updated periodically.
Usage details
The default update period is 10 minutes, as defined by the collectionPeriodInSecs attribute in the $SPLUNK_HOME/etc/apps/introspection_generator_addon/default/server.conf file.