Splunk Search
Highlighted

eventcount - spanning over time

Contributor

I'm attempting to write a search using eventcount command. I want to graph the number of events in my index/sourcetype per day over a span of 1 week. Can I use the eventcount for this? I'm not having much luck.

| eventcount summarize=false index=myindex sourcetype=mysourcetype 
| timechart span=1d count
0 Karma
Highlighted

Re: eventcount - spanning over time

SplunkTrust
SplunkTrust

The eventcount command just gives the count of events in the specified index, without any timestamp information. Since your search includes only the metadata fields (index/sourcetype), you can use tstats commands like this, much faster than regular search that you'd normally do to chart something like that.

| tstats count WHERE index=myindex sourcetype=mysourcetype by _time span=1d 

You might have to add | timechart span=1d sum(count) as count at the end if the chart doesn't look continuous.

View solution in original post

Highlighted

Re: eventcount - spanning over time

Contributor

great. thank you.

0 Karma