Splunk Search
Highlighted

How to search for and display the count of events per sourcetype in a table?

Builder

Hi all.

I have a search that begins with:

index="first" OR index="second" sourcetype=*

I need to show a table with a lot of columns. The first should be the total events in a particular sourcetype (data1). Somebody can suggest please an eval syntax to do that?

Regards.

0 Karma
Highlighted

Re: How to search for and display the count of events per sourcetype in a table?

Influencer

Just a point of advice: Don't use wildcards unless absolutely necessary. In this case, it really isn't doing anything for you at all. Without specifying sourcetype=* it will return all sourcetypes. But it's a horrible habit to get into. Wildcards are evil and should be avoided whenever possible.

0 Karma
Highlighted

Re: How to search for and display the count of events per sourcetype in a table?

Builder

Thanks for the advice!

0 Karma
Highlighted

Re: How to search for and display the count of events per sourcetype in a table?

Influencer
index=first OR index=second | stats count by sourcetype | fields count sourcetype

Maybe I'm misunderstanding the question.

EDIT: Second Attempt:

index=first OR index=second | 
stats count by sourcetype field1 field2 field3 | 
eventstats sum(count) as total by sourcetype | 
fields total sourcetype field1 field2 field3

View solution in original post

0 Karma
Highlighted

Re: How to search for and display the count of events per sourcetype in a table?

Builder

Thanks. I need something like:

index="first" OR index="second" | table EVENTSCOUNTINSOURCETYPEDATA1, field5, field3
0 Karma
Highlighted

Re: How to search for and display the count of events per sourcetype in a table?

Influencer

Maybe second attempt above is what you're after

0 Karma