Splunk Search

What is the least resource-intensive way to plot a line graph for event count for each sourcetype within a specified index?

kalik
Explorer

So I want to create a dashboard with each panel monitoring one index. Within a panel, it would be a timechart with count by time and each sourcetype would be represented by a separate line.

Here's a mockup of what I wanted to achieve:
alt text

I know it's pretty. Now the catch is - normal searches are gonna be very resource intensive and I'd rather have something lightweight if possible.

Any suggestions would be appreciated - I tried tstats but wasn't able to make it work in that manner.

Cheers!

1 Solution

somesoni2
Revered Legend

If you're just looking to plot event count by index and sourcetype, tstats would be the fastest way. Try like this

| tstats count WHERE index=YourIndex by _time sourcetype span=1d | timechart span=1d max(count) as count by sourcetype limit=0

View solution in original post

somesoni2
Revered Legend

If you're just looking to plot event count by index and sourcetype, tstats would be the fastest way. Try like this

| tstats count WHERE index=YourIndex by _time sourcetype span=1d | timechart span=1d max(count) as count by sourcetype limit=0

kalik
Explorer

Thanks @somesoni2, that's exacly what I was looking for!

0 Karma
Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...