Benp/add total event count

@rocha @brianhw @mulby 

I think it makes sense to get started on review. For now, could you ignore (or at most, skim) the test files? 

The prod code is worth a closer look at this point, and I welcome any feedback.
Do these actually occur? Either way, I'm not sure we actually want to exclude them from the count, since I suspect splunk won't filter them out of its count...