How to compare multiple sourcetypes?

[tonahoyos]

Hello,

In one index I have multiple sourcetypes. I want to be able to compare the values between these sourcetypes, but I do not know where to even start.

I was trying the following search:

index="log"
| stats count events if(sourcetype="SAT") as SAT

but this search seems very complicated. I want to be able to do something like:

|stats count events by sourcetype

but again, this doesn't work. Help!

[somesoni2 · Accepted solution]

If you're only interested in event count, you can use a rather efficient command tstats (works on metadata fields e.g. index/host/sourcetype/source etc which you seems to do)

To get a row for each sourcetype with count of events in selected time range

|tstats count WHERE index="log" by sourcetype         

To get a column for each sourcetype with count of events in selected time range

|tstats count WHERE index="log" by index sourcetype   | chart sum(count) by index sourcetype limit=0

[tonahoyos]

Perfect! Thank you!