Number of results returned by searches

[rmorlen]

We are building a dashboard displaying information on Splunk Performance.

One panel shows the number of searches that were run on any particular moment.

index=_audit host=searchhead* search!="" | timechart count by host

Is there a way to get the total number of results that were returned for each of those searches? Actually just want to know the total numbers of results that were returned during that time.

[rmorlen · Accepted solution]

Found the query I needed.

index=_audit host=searchhead* info=completed | timechart sum(event_count) by host