https://community.splunk.com/t5/Splunk-Search/Find-out-Number-of-Authentications-per-hour/m-p/188974#M187117 <P>We have logs coming in from an authentication system and we would like to chart out the number of authentications by Hour of the day (or Hours of the day) for the last x number of days just to check the peak authentication times.</P> <P>The query we have at the moment is<BR /> sourcetype=abc action=success | chart count(user) by date_hour</P> <P>but the result is:<BR /> Hour...... Count<BR /> 0............... 2<BR /> 1...............12<BR /> 2...............13<BR /> 3...............8<BR /> ......<BR /> 23.............. 6</P> <P>How can I get a result like:<BR /> Hour ....................Count<BR /> 00:00- 00:59............2<BR /> 1 :00- 1:59..............12<BR /> 2:00- 2:59 ............. 13<BR /> 3:00- 3:59............8<BR /> ......<BR /> 23:00- 23:59............ 6 </P> <P>Would it be possible to get a table or chart like above? </P> Thu, 22 Jan 2015 05:35:39 GMT mukeshb 2015-01-22T05:35:39Z https://community.splunk.com/t5/Splunk-Search/Find-out-Number-of-Authentications-per-hour/m-p/188974#M187117 <P>We have logs coming in from an authentication system and we would like to chart out the number of authentications by Hour of the day (or Hours of the day) for the last x number of days just to check the peak authentication times.</P> <P>The query we have at the moment is<BR /> sourcetype=abc action=success | chart count(user) by date_hour</P> <P>but the result is:<BR /> Hour...... Count<BR /> 0............... 2<BR /> 1...............12<BR /> 2...............13<BR /> 3...............8<BR /> ......<BR /> 23.............. 6</P> <P>How can I get a result like:<BR /> Hour ....................Count<BR /> 00:00- 00:59............2<BR /> 1 :00- 1:59..............12<BR /> 2:00- 2:59 ............. 13<BR /> 3:00- 3:59............8<BR /> ......<BR /> 23:00- 23:59............ 6 </P> <P>Would it be possible to get a table or chart like above? </P> Thu, 22 Jan 2015 05:35:39 GMT https://community.splunk.com/t5/Splunk-Search/Find-out-Number-of-Authentications-per-hour/m-p/188974#M187117 mukeshb 2015-01-22T05:35:39Z https://community.splunk.com/t5/Splunk-Search/Find-out-Number-of-Authentications-per-hour/m-p/188975#M187118 <P>Is this close enough?</P> <PRE><CODE>sourcetype=abc action=success | bucket _time span=1h | stats count by _time </CODE></PRE> Tue, 19 May 2015 17:49:00 GMT https://community.splunk.com/t5/Splunk-Search/Find-out-Number-of-Authentications-per-hour/m-p/188975#M187118 woodcock 2015-05-19T17:49:00Z