I have a forwarder installed on a server and I am extracting the data for indexes like Name,Class etc and while extracting I am also storing extraction information as shown below in **extraction_audit** index. This index also forwarded to indexer along with indexes Name, Class,Place so on.
**index**...............**begin_extraction_time**......**end_extraction_time**......**total_records_extracted**
Name ...............1457452861....................... ..145745287..........................150
Class................1457453260..........................1457453290........................100
School_details..1457453564..........................1457453575.........................25
Place................1457453612 .........................1457453620 ........................50
Other................1457453734..........................1457453744.........................10
Name................1457453892..........................1457453895.........................25
Place................1457454094..........................1457454096..........................5
Now how can I check in search heads **count by index** is same as **total_records_extracted** between **begin_extraction_time and end_extraction_time**.
For Example for **index=Name** between 1457452861 and 145745287, how to check **count by index** is equal or not equal to **total_records_extracted** which is in **index=extraction_audit**.
↧