topic Re: How to generate a search that will display event times by sourcetype? in Splunk Search

How to generate a search that will display event times by sourcetype?

lasonyadj — Fri, 10 Feb 2017 17:46:44 GMT

I am trying to write a search that will return a report of event times by hour for each sourcetype.

For example,

                      Source1      Source2    Source3             Total
1/1/17 1:00PM         5000         2000       500                 7500 
1/1/17 2:00PM         4000         1000       100                 5100

Any assistance will be appreciated.

Re: How to generate a search that will display event times by sourcetype?

rjthibod — Fri, 10 Feb 2017 18:18:40 GMT

This is should get you started

| tstats count where index=* by sourcetype _time span=1h 
| chart sum(count) limit=0 by _time span=1h sourcetype
| addtotals fieldname=Total
| where Total > 0

Re: How to generate a search that will display event times by sourcetype?

mpreddy — Fri, 10 Feb 2017 18:19:29 GMT

try like this:

index=_internal|eventstats count by sourcetype|timechart span=1h c by sourcetype | addtotals

Re: How to generate a search that will display event times by sourcetype?

lasonyadj — Fri, 10 Feb 2017 18:42:39 GMT

Thanks, that seemed to do the trick!!

Re: How to generate a search that will display event times by sourcetype?

lasonyadj — Fri, 10 Feb 2017 18:43:31 GMT

Thanks! this one only gave me the database stats but its a good starting point.