I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetype per day over a span of 1 week. Can I use the eventcount for this? I'm not having much luck.
The eventcount command just gives the count of events in the specified index, without any timestamp information. Since your search includes only the metadata fields (index/sourcetype), you can use tstats commands like this, much faster than regular search that you'd normally do to chart something like that.
| tstats count WHERE index=myindex sourcetype=mysourcetype by _time span=1d
You might have to add | timechart span=1d sum(count) as count at the end if the chart doesn't look continuous.