Archive

Find out Number of Authentications per hour

Explorer

We have logs coming in from an authentication system and we would like to chart out the number of authentications by Hour of the day (or Hours of the day) for the last x number of days just to check the peak authentication times.

The query we have at the moment is
sourcetype=abc action=success | chart count(user) by date_hour

but the result is:
Hour...... Count
0............... 2
1...............12
2...............13
3...............8
......
23.............. 6

How can I get a result like:
Hour ....................Count
00:00- 00:59............2
1 :00- 1:59..............12
2:00- 2:59 ............. 13
3:00- 3:59............8
......
23:00- 23:59............ 6

Would it be possible to get a table or chart like above?

Tags (1)
0 Karma

Esteemed Legend

Is this close enough?

sourcetype=abc action=success | bucket _time span=1h | stats count by _time
0 Karma