I could count against the raw data but it takes a long time. How can I more efficiently count on such stats?
Use tstats and specify the variables:
span=1s
| tstats count as COUNT where index=main earliest=-30d by _time,sourcetype span=1s | timechart span=1h max(COUNT) as eps by sourcetype
Use tstats and specify the variables:
span=1s
| tstats count as COUNT where index=main earliest=-30d by _time,sourcetype span=1s | timechart span=1h max(COUNT) as eps by sourcetype
might suggest a reformat (note in my search i do index=*
😞
| tstats count as COUNT where index=* earliest=-30d by _time, sourcetype span=1s
| timechart span=1h max(COUNT) as eps by sourcetype
FYI -
earliest=-30d and span=1s will produce 1 day = 86400 seconds * 30 days = 2,592,000
tstats will limit results to 50,000 hence the output of the search will truncate results.