Splunk Search

How to generate a search that will display event times by sourcetype?

lasonyadj
New Member

I am trying to write a search that will return a report of event times by hour for each sourcetype.

For example,

                      Source1      Source2    Source3             Total
1/1/17 1:00PM         5000         2000       500                 7500 
1/1/17 2:00PM         4000         1000       100                 5100

Any assistance will be appreciated.

0 Karma
1 Solution

rjthibod
Champion

This is should get you started

| tstats count where index=* by sourcetype _time span=1h 
| chart sum(count) limit=0 by _time span=1h sourcetype
| addtotals fieldname=Total
| where Total > 0

View solution in original post

0 Karma

mpreddy
Communicator

try like this:

index=_internal|eventstats count by sourcetype|timechart span=1h c by sourcetype | addtotals

0 Karma

lasonyadj
New Member

Thanks! this one only gave me the database stats but its a good starting point.

0 Karma

rjthibod
Champion

This is should get you started

| tstats count where index=* by sourcetype _time span=1h 
| chart sum(count) limit=0 by _time span=1h sourcetype
| addtotals fieldname=Total
| where Total > 0
0 Karma

lasonyadj
New Member

Thanks, that seemed to do the trick!!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...