Try something like this:
index=* sourcetype IN ("srctp1","srctp2"...) earliest=-96h latest=now | fields sourcetype _time | timechart span=24h count by sourcetype May 05, 2020 at 10:25AM
via reddit https://www.reddit.com/r/Splunk/comments/gdxcmj/dashboard_for_reporting_sourcetypes/fpk62pr?utm_source=ifttt