Every time Splunk adds up it indexing total for the previous 24 hours, it will compare that total with the peak it has previously recorded. If the new figure is higher, the existing record is replaced. If not, the record remains the same. It should never be reset, unless the indexes are cleaned.
Every time Splunk adds up it indexing total for the previous 24 hours, it will compare that total with the peak it has previously recorded. If the new figure is higher, the existing record is replaced. If not, the record remains the same. It should never be reset, unless the indexes are cleaned.