Splunk Search
Highlighted

What are better ways to provide counts?

New Member

Dear All,

There are 3 source types and we are pushing data into same index we need to give the count based on each source type.
I replied:

 Index= earliest ="-1y" latest ="now" | stats count by sourcetype.

Is there any faster way to provide counts apart from this way?

Regards,
Santosh

0 Karma
Highlighted

Re: What are better ways to provide counts?

SplunkTrust
SplunkTrust

try this:
| tstats count as event_count where index=<YOUR_INDEX_HERE> by sourcetpye
you can use the time picker or earliest and latest as tstats can use these arguments

hope it helps

View solution in original post

0 Karma
Highlighted

Re: What are better ways to provide counts?

SplunkTrust
SplunkTrust

Try tstats, although searching a year of data is likely to be slow regardless of the method used.

| tstats count where index=foo by sourcetype
---
If this reply helps you, an upvote would be appreciated.
0 Karma