You cannot use metrics.log's "per_sourcetype_thruput" for this because it only samples the top 10 busiest source types for every capture period of 30s. To accurately measure the rate of indexing of a given source type over time, you'd have to go to the events themselves and cursor your search using _indextime instead of _time, like so: index=cisco sourcetype="cisco_asa" | eval _time = _indextime | bin _time span=30m | stats count by _time | timechart span=30m per_second(count) AS EPS ... View more