Trying to create a scheduled report, to fire off a search and populate a summary index. Just want counts for each sourcetype into a new index called "index_summary". Planning to use this to track volume over time, changes in volume, possibly even do an alerrt if it changes by say 300% +/- etc.
Trying
|tstats count where index=* by date_hour index sourcetype
but not really seeing the results as they will need to be. Looking to populate Date/Time (most likelys hourly), index, sourcetype, count. Any help would be appreciated.
