topic eventcount - spanning over time in Splunk Search

eventcount - spanning over time

brdr — Wed, 23 May 2018 17:31:04 GMT

I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetype per day over a span of 1 week. Can I use the eventcount for this? I'm not having much luck.

| eventcount summarize=false index=myindex sourcetype=mysourcetype 
| timechart span=1d count

Re: eventcount - spanning over time

somesoni2 — Wed, 23 May 2018 18:22:29 GMT

The eventcount command just gives the count of events in the specified index, without any timestamp information. Since your search includes only the metadata fields (index/sourcetype), you can use tstats commands like this, much faster than regular search that you'd normally do to chart something like that.

| tstats count WHERE index=myindex sourcetype=mysourcetype by _time span=1d

You might have to add | timechart span=1d sum(count) as count at the end if the chart doesn't look continuous.

Re: eventcount - spanning over time

brdr — Thu, 24 May 2018 17:12:28 GMT

great. thank you.