fields @timestamp | stats count(*) as EventsCountBySource by source | sort @timestamp desc