Benp/add total event count

@rocha @brianhw @mulby 

I think it makes sense to get started on review. For now, could you ignore (or at most, skim) the test files? 

The prod code is worth a closer look at this point, and I welcome any feedback.
The real examples I ran into was when timestamp was missing. Those didn't get indexed by splunk (though, if the timestamp was missing in the event, there were other things wrong with it...)