fields @timestamp
| stats count(*) as EventsCountBySource by source
| sort @timestamp desc