| tstats count where index=* sourcetype=* by index sourcetype source host
You only have access to metadata, i.e. Indexed fields but no search-time fields.
End credits