Count Events From Each Datasource

Count events from each datasource by using eventInternals() function to add storage location to each event

Query

logscale
eventInternals()
| groupBy([@datasourceId])

Introduction

The eventInternals() function is used to add the storage locations of this event. The eventInternals() function augments the event data with the event field count information.

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    eventInternals()

    Adds a @datasourceId field describing the storage locations of the event.

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1>Augment Data] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | groupBy([@datasourceId])

    Groups the events based on the @datasourceId, performs a count of the events and returns the results in a _count field.

  4. Event Result set.

Summary and Results

The query is used to find the number of events per datasource.