Create summary index to count events by sourcetype every hour

[joesrepsolc]

Trying to create a scheduled report, to fire off a search and populate a summary index. Just want counts for each sourcetype into a new index called "index_summary". Planning to use this to track volume over time, changes in volume, possibly even do an alerrt if it changes by say 300% +/- etc.

Trying
|tstats count where index=* by date_hour index sourcetype

but not really seeing the results as they will need to be. Looking to populate Date/Time (most likelys hourly), index, sourcetype, count. Any help would be appreciated.

[to4kawa]

see reference and use span= not date_hour
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats