Knowledge Management

Create summary index to count events by sourcetype every hour

joesrepsolc
Communicator

Trying to create a scheduled report, to fire off a search and populate a summary index. Just want counts for each sourcetype into a new index called "index_summary". Planning to use this to track volume over time, changes in volume, possibly even do an alerrt if it changes by say 300% +/- etc.

Trying
|tstats count where index=* by date_hour index sourcetype

but not really seeing the results as they will need to be. Looking to populate Date/Time (most likelys hourly), index, sourcetype, count. Any help would be appreciated.

Labels (1)
0 Karma

to4kawa
SplunkTrust
SplunkTrust
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!