How to edit my search to display individual event counts for each sourcetype?

[bluemarvel]

I have the following search and it works pretty well, however I need to see the event counts for each of the sourcetypes individually not as total count.

index=windows (splunk_server=* OR splunk_server=*) OR (sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:Application" OR sourcetype="WinEventLog:System") | chart count values(sourcetype) as index by splunk_server |  table splunk_server index count | rename splunk_server TO abc-host |  rename index TO Log-Type

[rjthibod · Accepted solution]

If I understood the original intention of you search filter, using tstats will be faster.

| tstats count where index=windows OR (sourcetype="WinEventLog:Security" OR sourcetype="WinEventLog:Application" OR sourcetype="WinEventLog:System") by index sourcetype splunk_server 
| table sourcetype splunk_server index count 
| rename splunk_server TO abc-host 
| rename index TO Log-Type

[bluemarvel]

yes, it did thank you, had to re-arrange some things

[rjthibod]

Glad to hear it was straightened out.

[bluemarvel]

not exactly ----the query gives me a total count of for all of the sources combined , I would like to see totals of each individually
total :135014
MSAD:NT6:DNS-Health
MSAD:NT6:DNS-Zone-Information
MSAD:NT6:Health
MSAD:NT6:Netlogon
MSAD:NT6:Replication
MSAD:NT6:SiteInfo
WinEventLog:DNS-Server
WinEventLog:Directory-Service
WindowsUpdateLog

[rjthibod]

I think I am missing something. The query I provided should give you a table with the total count of events per index, sourcetype, and server. For example, here is my own data using my query (I MD5'ed my host field). If this was your data, what field am I missing or what is out of place, because your last response does not clarify the request for me. Sorry.

 sourcetype               abc-host      Log-Type      count
 WinEventLog:Application  f6a667...   wineventlog     140
 WinEventLog:Security    f6a667...   wineventlog     169
 WinEventLog:System    f6a667...   wineventlog      611

[rjthibod]

@bluemarvel, did my answer give you what you needed?