Getting Data In

How to find monitored csv files with more than a 100k rows?

jiaqya
Builder

Is there a log or a command output that I can use to determine the number of rows each CSV file that is being monitored has?

I am looking for this info so I can find out how many of the CSV files are more than 100k rows to resolve another issue that I am facing.

Thanks

0 Karma
1 Solution

niketn
Legend

@jiaqya, based on whether you have defined a specific index or sourcetype for the CSV files you can try tstats command to get count of events

| tstats count where index=<yourIndexName> by source

OR

| tstats count where index=<yourIndexName> AND sourcetype=<yourSourceType> by source

Following is a run anywhere search based on Splunk's _internal index for sourcetype=splunkd

| tstats count where index=_internal AND sourcetype=splunkd by source
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@jiaqya, based on whether you have defined a specific index or sourcetype for the CSV files you can try tstats command to get count of events

| tstats count where index=<yourIndexName> by source

OR

| tstats count where index=<yourIndexName> AND sourcetype=<yourSourceType> by source

Following is a run anywhere search based on Splunk's _internal index for sourcetype=splunkd

| tstats count where index=_internal AND sourcetype=splunkd by source
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

jiaqya
Builder

This surely is one way, thanks.

john.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...