Graphing off Tstats - total mental block

[aymonfoa]

Got a search like this (I've obfuscated it a bit)

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")

Got a great looking stats table - and Im really pleased with the performance of tstats - awesome.

I want to graph the results... easy right?  well no - I cannot for the life of me seem to break down a say, 60 minute span down by host, despite the fact I got this awesome oven ready totally graphable stats table

so I am trying 

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart count by host

but the count is counting the host, whereas I want to "count the count" ?  Any ideas?  this will be a super simple one I expect - I got a total mental block on this

[bowesmana · Accepted solution]

You can either use the prestats option as @richgalloway suggests, or the alternative way is to use count in tstats, then sum(count) in timechart, i.e.

| tstats count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart sum(count) by host

[richgalloway]

Add the prestats option to the tstats command.  That will format the results for timechart to use.

| tstats prestats=t count where index IN (index1, index2, index3) by _time , host
| where match(host,"^.*.device.mycompany.com$")
| timechart count by host