I'm trying to count the number of events for a specific index/sourcetype combo, and then total them into a new field, using eval. I've tried this, but looks like my logic is off, as the numbers are very weird - looks like it's counting the number of splunk servers. I want to count the number of events per splunk_server and then total them into a new field named splunk_region.
|tstats count WHERE index=cisco AND sourcetype="cisco:asa" by splunk_server _time
| eval splunk_region = case(like(splunk_server,"%bos-%"),"BOS" ,
like(splunk_server, "%lax-%"), "LAX",
| timechart span=1d count by splunk_region