Splunk Search

How to search total events by sourcetype using tstats with timechart to put in a summary index?

mwdbhyat
Builder

Hi,

I need a top count of the total number of events by sourcetype to be written in tstats(or something as fast) with timechart put into a summary index, and then report on that SI. Using sitimechart changes the columns of my inital tstats command, so I end up having no count to report on. Any thoughts? My initial search before the sitimechart is:

| tstats count where index=main* groupby sourcetype _time

Thanks

1 Solution

inventsekar
SplunkTrust
SplunkTrust

try this one -

 | tstats count WHERE index=* by sourcetype _time

or, main* is required, then

 | tstats count WHERE index=main* by sourcetype _time
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

inventsekar
SplunkTrust
SplunkTrust

try this one -

 | tstats count WHERE index=* by sourcetype _time

or, main* is required, then

 | tstats count WHERE index=main* by sourcetype _time
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

mwdbhyat
Builder

I found out the issue - I was just being an idiot and wrote my si command differently to the actual timechart. Thanks anyway!

0 Karma

inventsekar
SplunkTrust
SplunkTrust

regarding that timechart, you can check this one..

| tstats count WHERE index=main by _time host sourcetype span=30m | timechart span=30m sum(count) by sourcetype

if the issue is resolved, can you accept this answer.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...