https://community.splunk.com/t5/Splunk-Search/How-to-compare-multiple-sourcetypes/m-p/380310#M169719 <P>If you're only interested in event count, you can use a rather efficient command <CODE>tstats</CODE> (works on metadata fields e.g. index/host/sourcetype/source etc which you seems to do)</P> <P>To get a row for each sourcetype with count of events in selected time range</P> <PRE><CODE>|tstats count WHERE index="log" by sourcetype </CODE></PRE> <P>To get a column for each sourcetype with count of events in selected time range</P> <PRE><CODE>|tstats count WHERE index="log" by index sourcetype | chart sum(count) by index sourcetype limit=0 </CODE></PRE> Wed, 02 May 2018 18:23:29 GMT somesoni2 2018-05-02T18:23:29Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-multiple-sourcetypes/m-p/380309#M169718 <P>Hello,</P> <P>In one index I have multiple sourcetypes. I want to be able to compare the values between these sourcetypes, but I do not know where to even start. </P> <P>I was trying the following search:</P> <P>index="log" <BR /> | stats count events if(sourcetype="SAT") as SAT</P> <P>but this search seems very complicated. I want to be able to do something like:</P> <P>|stats count events by sourcetype </P> <P>but again, this doesn't work. Help! </P> Wed, 02 May 2018 18:15:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-multiple-sourcetypes/m-p/380309#M169718 tonahoyos 2018-05-02T18:15:53Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-multiple-sourcetypes/m-p/380310#M169719 <P>If you're only interested in event count, you can use a rather efficient command <CODE>tstats</CODE> (works on metadata fields e.g. index/host/sourcetype/source etc which you seems to do)</P> <P>To get a row for each sourcetype with count of events in selected time range</P> <PRE><CODE>|tstats count WHERE index="log" by sourcetype </CODE></PRE> <P>To get a column for each sourcetype with count of events in selected time range</P> <PRE><CODE>|tstats count WHERE index="log" by index sourcetype | chart sum(count) by index sourcetype limit=0 </CODE></PRE> Wed, 02 May 2018 18:23:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-multiple-sourcetypes/m-p/380310#M169719 somesoni2 2018-05-02T18:23:29Z https://community.splunk.com/t5/Splunk-Search/How-to-compare-multiple-sourcetypes/m-p/380311#M169720 <P>Perfect! Thank you!</P> Wed, 02 May 2018 18:43:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-compare-multiple-sourcetypes/m-p/380311#M169720 tonahoyos 2018-05-02T18:43:56Z