Graph total events over time

[chrisdev]

Hi all,

Im attempting to create a graph that plots total number of events over time. I have tried various usages of timechart, which does not have the desired effect. 

sourcetype=* index=* | timechart span=1h count

This yields the following result:

The total number of events in this example is 16, however the data points on the graph correspond to imports and go from 0 -> 13 -> 3. Is there any way I can plot the total number of events over time (so the 3 data point actually becomes 16)?

Thanks in advance for any assistance.

[ITWhisperer · Accepted solution]

| streamstats sum(count) as total