Count number of incidents per hour\day

[scottmkirkland]

I'm trying to get a table or heatmap of a count of incidents that occur by day and hour....My results make sense, except I'm only getting hours 8 through 20. I know incidents occur round the clock. So, I should be seeing a count for each hour.

Any suggestions?

| eval date_hour=strftime(_time, "%H") 
| eval date_wday=strftime(_time, "%A")  
| chart dc(RMI_MastIncNumb) AS incidents over date_wday by date_hour useother=f 
| eval wd=lower(date_wday) 
| eval sort_field=case(wd=="monday",2, wd=="tuesday",3, wd=="wednesday",4, wd=="thursday",5, wd=="friday",6, wd=="saturday",7, wd="sunday", 1)
| sort sort_field
| fields - sort_field wd

[ITWhisperer · Accepted solution]

| eval date_hour=strftime(_time, "%H") 
| eval date_wday=strftime(_time, "%A")  
| chart dc(RMI_MastIncNumb) AS incidents over date_wday by date_hour useother=f limit=0 
| eval wd=lower(date_wday) 
| eval sort_field=case(wd=="monday",2, wd=="tuesday",3, wd=="wednesday",4, wd=="thursday",5, wd=="friday",6, wd=="saturday",7, wd="sunday", 1)
| sort sort_field
| fields - sort_field wd