Can you help me figure out why my query is not working?

[VijaySrrie]

index=* |stats count by sourcetype |table index sourcetype count

The above query displays the sourcetype and count details, but not the index details, Please help me figure out how to proceed.

[amiracle]

You might want to look at this free course as well: https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html

[vnravikumar · Accepted solution]

Hi

try like

index=* |stats count by sourcetype, index

[skoelpin]

Fixed.. Don't use index=* when searching over index time fields

| metasearch 
| stats count by sourcetype, index

[VijaySrrie]

|metasearch index=* | stats count by sourcetype, index

is working fine