topic Re: group search results by hour of day in Splunk Search

group search results by hour of day

gerbert — Tue, 13 Apr 2021 08:12:49 GMT

Hi splunk community,

I feel like this is a very basic question but I couldn't get it to work.

I want to search my index for the last 7 days and want to group my results by hour of the day. So the result should be a column chart with 24 columns.
So for example my search looks like this:

index=myIndex status=12 user="gerbert" | table status user _time

I want a chart that tells me how many counts i got over the last 7 days grouped by the hour of the day for a specific user and status number.

Cheers
gerbert

Re: group search results by hour of day

ITWhisperer — Tue, 13 Apr 2021 08:30:30 GMT

index=myIndex status=12 user="gerbert" | stats count by date_hour

Re: group search results by hour of day

gerbert — Tue, 13 Apr 2021 08:50:07 GMT

Thanks for your help.

I already tried "group by date_hour" before posting here. It didn't give me the right results I was looking for.
I found another post with an answer. What worked for me in the end was:

index=myIndex status=12 user="gerbert" | eval hour = strftime(_time, "%H") | stats count by hour | sort hour