How can I convert a naive timechart command to an efficient one?

[ddrillic]

The following works fine for me -

sourcetype=<sourcetype> index=<index> | timechart span=1d count 

How can I convert it to an efficient eventstats or tstats command?

[somesoni2 · Accepted solution]

The tstats version will be like this

| tstats count WHERE index=<index> sourcetype=<sourcetype> by _time span=1d 

If you don't the visualization right, just add this as well to above search

above search | timechart span=1d sum(count) as count

[ddrillic]

Gorgeous @somesoni2. You put a new picture! - I'm afraid to put mine - too scary ; -)