https://community.splunk.com/t5/Splunk-Search/tstats-search-that-I-can-group-over-time-for-each-of-my-indexes/m-p/391193#M113902 <P>Try this: <CODE>| tstats count where sourcetype=* by index _time span=1d | timechart sum(count) by index</CODE></P> Thu, 04 Apr 2019 19:41:29 GMT chrisyounger 2019-04-04T19:41:29Z https://community.splunk.com/t5/Splunk-Search/tstats-search-that-I-can-group-over-time-for-each-of-my-indexes/m-p/391192#M113901 <P>Hello ,<BR /> I'm looking for assistance with an SPL search utilizing the tstats command that I can group over a specified amount of time for each of my indexes</P> <P>I have this command to view the entire ingestion but how can I parse it to show each index?</P> <P>| tstats count where sourcetype=* by _time span=1d</P> <P>thank you</P> Thu, 04 Apr 2019 19:37:55 GMT https://community.splunk.com/t5/Splunk-Search/tstats-search-that-I-can-group-over-time-for-each-of-my-indexes/m-p/391192#M113901 bzsplunk54 2019-04-04T19:37:55Z https://community.splunk.com/t5/Splunk-Search/tstats-search-that-I-can-group-over-time-for-each-of-my-indexes/m-p/391193#M113902 <P>Try this: <CODE>| tstats count where sourcetype=* by index _time span=1d | timechart sum(count) by index</CODE></P> Thu, 04 Apr 2019 19:41:29 GMT https://community.splunk.com/t5/Splunk-Search/tstats-search-that-I-can-group-over-time-for-each-of-my-indexes/m-p/391193#M113902 chrisyounger 2019-04-04T19:41:29Z https://community.splunk.com/t5/Splunk-Search/tstats-search-that-I-can-group-over-time-for-each-of-my-indexes/m-p/391194#M113903 <P>that is complete awesomeness ! thank you....</P> Thu, 04 Apr 2019 19:51:08 GMT https://community.splunk.com/t5/Splunk-Search/tstats-search-that-I-can-group-over-time-for-each-of-my-indexes/m-p/391194#M113903 bzsplunk54 2019-04-04T19:51:08Z