topic Re: Display EventCount for specific index. in Splunk Search

Display EventCount for specific index.

shinde0509 — Tue, 24 Nov 2020 08:04:04 GMT

Want to count all events from specific indexes say abc, pqr and xyz only for span of 1h using tstats
and present it in timechart.

Tried this but now working

| tstats count WHERE earliest=-1d@-3h latest=now index=ABC,PQR,XYZ by index, _time span=1h | timechart sum(count) as count by index.

Re: Display EventCount for specific index.

thambisetty — Tue, 24 Nov 2020 09:50:55 GMT

@shinde0509

| tstats count where index IN (windows,nix) by _time, span=1h , index | chart values(count) as count over _time by index

Re: Display EventCount for specific index.

isoutamo — Tue, 24 Nov 2020 16:21:12 GMT

You can try this:

| tstats count WHERE earliest=-1d@-3h latest=now index IN (ABC,PQR,XYZ) by index _time span=1h prestats=t | timechart span=1h count as count by index.

You must use count on both and also span must be the same.

r. Ismo

Re: Display EventCount for specific index.

shinde0509 — Tue, 24 Nov 2020 16:07:29 GMT

NO, Getting graph only for first index.

Re: Display EventCount for specific index.

shinde0509 — Tue, 24 Nov 2020 16:08:51 GMT

Thanks, Working.

Re: Display EventCount for specific index.

isoutamo — Tue, 24 Nov 2020 16:22:02 GMT

Sorry, I just copied that from your example. It must be index IN (ABC, PQR,XYZ) or in the old way index = ABC OR index = PQR OR index = XYZ. Fixed into my previous reply.