Splunk Search

How to search total events by sourcetype using tstats with timechart to put in a summary index?

mwdbhyat
Builder

Hi,

I need a top count of the total number of events by sourcetype to be written in tstats(or something as fast) with timechart put into a summary index, and then report on that SI. Using sitimechart changes the columns of my inital tstats command, so I end up having no count to report on. Any thoughts? My initial search before the sitimechart is:

| tstats count where index=main* groupby sourcetype _time

Thanks

0 Karma
1 Solution

inventsekar
Super Champion

try this one -

 | tstats count WHERE index=* by sourcetype _time

or, main* is required, then

 | tstats count WHERE index=main* by sourcetype _time

View solution in original post

0 Karma

inventsekar
Super Champion

try this one -

 | tstats count WHERE index=* by sourcetype _time

or, main* is required, then

 | tstats count WHERE index=main* by sourcetype _time

View solution in original post

0 Karma

mwdbhyat
Builder

I found out the issue - I was just being an idiot and wrote my si command differently to the actual timechart. Thanks anyway!

0 Karma

inventsekar
Super Champion

regarding that timechart, you can check this one..

| tstats count WHERE index=main by _time host sourcetype span=30m | timechart span=30m sum(count) by sourcetype

if the issue is resolved, can you accept this answer.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!