eventcount - spanning over time

[brdr]

I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetype per day over a span of 1 week. Can I use the eventcount for this? I'm not having much luck.

| eventcount summarize=false index=myindex sourcetype=mysourcetype 
| timechart span=1d count

[somesoni2 · Accepted solution]

The eventcount command just gives the count of events in the specified index, without any timestamp information. Since your search includes only the metadata fields (index/sourcetype), you can use tstats commands like this, much faster than regular search that you'd normally do to chart something like that.

| tstats count WHERE index=myindex sourcetype=mysourcetype by _time span=1d 

You might have to add | timechart span=1d sum(count) as count at the end if the chart doesn't look continuous.

[brdr]

great. thank you.