Trend by sourcetype?

[echojacques]

Hello,

How can I get a trend of total events by sourcetype in a graph over a week? My indexing volume dropped significantly and I'm having trouble identifying which one of my sourcetypes is indexing less data today vs 1 week ago.

Thanks!

[echojacques · Accepted solution]

Ok I figured it out, this search will chart the KB per sourcetype instead of events per sourcetype but it still works to identify indexing volume changes by sourcetype:

index="_internal" source="*metrics.log" per_sourcetype_thruput | timechart sum(kb) by series