https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447726#M126895 <P>@gauravepi,</P> <P>Try</P> <PRE><CODE>eventtype="abc" |fields d_in,d_to,d_up,err,p_to,hour|stats sum(*) as * by hour </CODE></PRE> Thu, 19 Jul 2018 13:43:06 GMT renjith_nair 2018-07-19T13:43:06Z https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447721#M126890 <P>I have some fields in my Splunk search now i want to use them to create a search query so that i can pull those information into a graph. On splunk i want to show hourly(hour field) how many d_in , d_to d_up ,err and p_to are there . Below are the field which i have </P> <PRE><CODE>d_in = 4027 d_to = 336210 d_up = 332183 hour = 12 err = 0 p_to = 264749 d_in = 427 d_to = 3210 d_up = 2183 hour = 13 err = 2 p_to = 249 </CODE></PRE> <P>I am new in Splunk please help me in this . I am using below query to in the search to get above fields :</P> <PRE><CODE>eventtype="abc" </CODE></PRE> Tue, 29 Sep 2020 20:31:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447721#M126890 gauravepi 2020-09-29T20:31:01Z https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447722#M126891 <P>Will there be one event for each hour value, or is it possible to have more than one event at the same hour?</P> Wed, 18 Jul 2018 18:37:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447722#M126891 kmorris_splunk 2018-07-18T18:37:06Z https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447723#M126892 <P>Whats the expected output?</P> Wed, 18 Jul 2018 18:45:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447723#M126892 somesoni2 2018-07-18T18:45:37Z https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447724#M126893 <P>Yes there will be only one event for each hour </P> Wed, 18 Jul 2018 18:50:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447724#M126893 gauravepi 2018-07-18T18:50:28Z https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447725#M126894 <P>For 13 hours : Total d_in 427 if there is data-set for hour 13 having d_in = 12<BR /> Then total d_in is 427+12 = 439<BR /> So total d_in in 13th hour is 439 likewise for each field </P> Tue, 29 Sep 2020 20:31:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447725#M126894 gauravepi 2020-09-29T20:31:04Z https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447726#M126895 <P>@gauravepi,</P> <P>Try</P> <PRE><CODE>eventtype="abc" |fields d_in,d_to,d_up,err,p_to,hour|stats sum(*) as * by hour </CODE></PRE> Thu, 19 Jul 2018 13:43:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-hourly-stats-into-a-graph/m-p/447726#M126895 renjith_nair 2018-07-19T13:43:06Z