Splunk Search

How to generate a search that will display event times by sourcetype?

New Member

I am trying to write a search that will return a report of event times by hour for each sourcetype.

For example,

                      Source1      Source2    Source3             Total
1/1/17 1:00PM         5000         2000       500                 7500 
1/1/17 2:00PM         4000         1000       100                 5100

Any assistance will be appreciated.

0 Karma
1 Solution

Champion

This is should get you started

| tstats count where index=* by sourcetype _time span=1h 
| chart sum(count) limit=0 by _time span=1h sourcetype
| addtotals fieldname=Total
| where Total > 0

View solution in original post

0 Karma

Communicator

try like this:

index=_internal|eventstats count by sourcetype|timechart span=1h c by sourcetype | addtotals

0 Karma

New Member

Thanks! this one only gave me the database stats but its a good starting point.

0 Karma

Champion

This is should get you started

| tstats count where index=* by sourcetype _time span=1h 
| chart sum(count) limit=0 by _time span=1h sourcetype
| addtotals fieldname=Total
| where Total > 0

View solution in original post

0 Karma

New Member

Thanks, that seemed to do the trick!!

0 Karma