events per second on a sourcetype

[a212830]

Hi,

How would I go about getting events per second on a sourcetype?

[aholzer]

Note that there is a cap on the number of results you can display on a chart. If you are going to use a 1s (one second) span, then you are going to have to limit the time range you are looking at significantly. Specially if you have multiple sourcetypes that you are charting.

[MuS]

Hi a212830

updated

I think you are looking for this

yourSearch | bucket _time span=1s | chart count over _time by sourcetype

not for this

yourSearch | timechart span=1s count by sourcetype

cheers, MuS