How to search total events by sourcetype using tstats with timechart to put in a summary index?

[mwdbhyat]

Hi,

I need a top count of the total number of events by sourcetype to be written in tstats(or something as fast) with timechart put into a summary index, and then report on that SI. Using sitimechart changes the columns of my inital tstats command, so I end up having no count to report on. Any thoughts? My initial search before the sitimechart is:

| tstats count where index=main* groupby sourcetype _time

Thanks

[inventsekar · Accepted solution]

try this one -

 | tstats count WHERE index=* by sourcetype _time

or, main* is required, then

 | tstats count WHERE index=main* by sourcetype _time

[mwdbhyat]

I found out the issue - I was just being an idiot and wrote my si command differently to the actual timechart. Thanks anyway!

[inventsekar]

regarding that timechart, you can check this one..

| tstats count WHERE index=main by _time host sourcetype span=30m | timechart span=30m sum(count) by sourcetype

if the issue is resolved, can you accept this answer.