How can we get a fast report of data breakdown for one index?

[ddrillic]

How can we get a fast report of data breakdown per day or month for one index?

[MuS · Accepted solution]

Hi ddrillic,

how about tstats ? Try this run everywhere command:

| tstats count where index=* by _time, index, sourcetype

Hope this helps ...

cheers, MuS

[ddrillic]

Thank you experts.

[somesoni2]

I would include the span parameter as well, since the requirement is to bucket by time

| tstats count where index=* by _time, index, sourcetype span=1d