Splunk Search

eventcount - spanning over time

Contributor

I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetype per day over a span of 1 week. Can I use the eventcount for this? I'm not having much luck.

| eventcount summarize=false index=myindex sourcetype=mysourcetype 
| timechart span=1d count
1 Solution

SplunkTrust
SplunkTrust

The eventcount command just gives the count of events in the specified index, without any timestamp information. Since your search includes only the metadata fields (index/sourcetype), you can use tstats commands like this, much faster than regular search that you'd normally do to chart something like that.

| tstats count WHERE index=myindex sourcetype=mysourcetype by _time span=1d 

You might have to add | timechart span=1d sum(count) as count at the end if the chart doesn't look continuous.

View solution in original post

SplunkTrust
SplunkTrust

The eventcount command just gives the count of events in the specified index, without any timestamp information. Since your search includes only the metadata fields (index/sourcetype), you can use tstats commands like this, much faster than regular search that you'd normally do to chart something like that.

| tstats count WHERE index=myindex sourcetype=mysourcetype by _time span=1d 

You might have to add | timechart span=1d sum(count) as count at the end if the chart doesn't look continuous.

View solution in original post

Contributor

great. thank you.

0 Karma