eventtype=* |stats count by eventtype which works.
However, in a dashboard below query doesn't work. Any suggestions please?
index=$111111$ $22222$ eventtype=* |stats count by eventtype
I think you want:
(index=$111111$ OR index=$22222$) eventtype=* |stats count by eventtype
@nickhillscpl - you may be right. That $22222$ may be the issue, if it is intended to be an index. I'd also be worried about token names that are purely numeric. I didn't find a reference for token naming conventions, but all the examples start with an alpha, and all numeric token names seem potentially problematic.