https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-SQL-query-to-splunk-search/m-p/267568#M80497 <P>Try something like,</P> <PRE><CODE>index=foo sourceltype=bar MSG_NUM=cma* | bucket span=1h _time | stats dc(CHNL) as uniq_channels by _time MSG_TM </CODE></PRE> <P>or</P> <PRE><CODE>index=foo sourceltype=bar MSG_NUM=cma* | timechart span=1h dc(CHNL) by MSG_TM </CODE></PRE> Thu, 02 Feb 2017 16:50:06 GMT somesoni2 2017-02-02T16:50:06Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-SQL-query-to-splunk-search/m-p/267566#M80495 <P>Hi , <BR /> I have a sql query ,<BR /> Count distinct CHNL where MSG_NUM like 'cma%' group by MSG_TM. <BR /> Result should get display in hourly basis,</P> <P>all the CHNL , MSG_NUM , MSG_TM is the column name , which has values . Kindly need your help to convert it .Result should be in hourly basis.</P> Tue, 29 Sep 2020 12:39:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-SQL-query-to-splunk-search/m-p/267566#M80495 benazir 2020-09-29T12:39:23Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-SQL-query-to-splunk-search/m-p/267567#M80496 <P>Is your data already indexed or are you trying to read a SQL database from Splunk? If the former, see <A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SQLtoSplunk">http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SQLtoSplunk</A>. If the latter, check out the Splunk DB Connect app.</P> Thu, 02 Feb 2017 12:45:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-SQL-query-to-splunk-search/m-p/267567#M80496 richgalloway 2017-02-02T12:45:00Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-SQL-query-to-splunk-search/m-p/267568#M80497 <P>Try something like,</P> <PRE><CODE>index=foo sourceltype=bar MSG_NUM=cma* | bucket span=1h _time | stats dc(CHNL) as uniq_channels by _time MSG_TM </CODE></PRE> <P>or</P> <PRE><CODE>index=foo sourceltype=bar MSG_NUM=cma* | timechart span=1h dc(CHNL) by MSG_TM </CODE></PRE> Thu, 02 Feb 2017 16:50:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-SQL-query-to-splunk-search/m-p/267568#M80497 somesoni2 2017-02-02T16:50:06Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-SQL-query-to-splunk-search/m-p/267569#M80498 <P>Thank you so much it works perfect with few modification.</P> Sun, 05 Feb 2017 14:14:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-this-SQL-query-to-splunk-search/m-p/267569#M80498 benazir 2017-02-05T14:14:39Z