https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306088#M91894 <P>Like this:</P> <PRE><CODE>index="ABC" sourcetype="XYZ" | bin _time span=1h | stats count(eval(responsecode="200")) AS success count BY _time </CODE></PRE> Thu, 30 Mar 2017 15:00:47 GMT woodcock 2017-03-30T15:00:47Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306084#M91890 <P>i want to list out the success count by time<BR /> Example:</P> <P>index="ABC" sourcetype="XYZ" responsecode="200"|</P> <H2>Time count</H2> <P>last 1hour(1:00am) 20<BR /> other 1hour(2:00am) 10</P> <P>please help me with sample query</P> Thu, 30 Mar 2017 14:46:53 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306084#M91890 sravankaripe 2017-03-30T14:46:53Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306085#M91891 <P>is that what you are looking for?<BR /> .... | timechart span=1h count</P> Thu, 30 Mar 2017 14:53:58 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306085#M91891 adonio 2017-03-30T14:53:58Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306086#M91892 <P>Hi</P> <P>index="ABC" sourcetype="XYZ" responsecode="200"| timechart span=1h count </P> <P>3no.</P> Thu, 30 Mar 2017 14:55:59 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306086#M91892 3no 2017-03-30T14:55:59Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306087#M91893 <P>index="ABC" sourcetype="XYZ" responsecode="200"|timechart span=1h count </P> <P>refer this one <BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/timechart</A></P> Thu, 30 Mar 2017 14:56:57 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306087#M91893 kiran331 2017-03-30T14:56:57Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306088#M91894 <P>Like this:</P> <PRE><CODE>index="ABC" sourcetype="XYZ" | bin _time span=1h | stats count(eval(responsecode="200")) AS success count BY _time </CODE></PRE> Thu, 30 Mar 2017 15:00:47 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306088#M91894 woodcock 2017-03-30T15:00:47Z https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306089#M91895 <P>Hi sravankaripe,<BR /> you can use timechart command to count the number of events in every hour:</P> <PRE><CODE>index="ABC" sourcetype="XYZ" responsecode="200" | timechart count span=1h </CODE></PRE> <P>In addition, you can also compare count of each hour with the corresponding hour of e.g. last week using timewrap command (see <A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Timewrap):">http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Timewrap):</A></P> <PRE><CODE>index="ABC" sourcetype="XYZ" responsecode="200" | timechart count span=1h | timewrap 1week </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Thu, 30 Mar 2017 15:16:09 GMT https://community.splunk.com/t5/Splunk-Search/Help-me-with-search-query-for-my-usecase/m-p/306089#M91895 gcusello 2017-03-30T15:16:09Z