Knowledge Management

Create summary index to count events by sourcetype every hour


Trying to create a scheduled report, to fire off a search and populate a summary index. Just want counts for each sourcetype into a new index called "index_summary". Planning to use this to track volume over time, changes in volume, possibly even do an alerrt if it changes by say 300% +/- etc.

|tstats count where index=* by date_hour index sourcetype

but not really seeing the results as they will need to be. Looking to populate Date/Time (most likelys hourly), index, sourcetype, count. Any help would be appreciated.

Labels (1)
0 Karma

Ultra Champion
0 Karma