How to use
index="*"|timechart count by sourcetype,source
As an fast solution you might combine the two fields into one field with eval and use the result as by clause:
index=_internal | eval combi=source."#".sourcetype | timechart count by combi
I don't know what exactly you want to know. There are examples for inpage drilldowns in the splunk 6.1 overview app. https://apps.splunk.com/app/1773/
You should be able to take the combi field as a normal token. If you want to split it up again in source and sourcetype, you can use the rex command:
index=_internal | eval combi=source."#".sourcetype | rex field=combi "(?<first_part>^.*)#(?<second_part>.*$)"