How do I take an hourly count of one field value for all available hosts?

[zeespl]

I want to create a dashboard for below.

There are two fields: "clientip" and "hosts".

I want to calculate the number of connections made by each IP in an hour for all available hosts. This data I need is for 12 hours.

I tried the below query, but it doesn't work..

..| chart dc(clientip) over date_hour by hosts usenull=f

@niketnilay : Could you please advise?

[davidcruz]

Have you tried

..| timechart dc(clientip) span=1h by hosts usenull=f

[niketn]

@zeespl , could you please explain what is not working? Your current query should give unique clientips that logs event per hour for each host?

By any chance are you interested in count() and not dc()?

 <yourBaseSearch> earliest=-12h latest=now
| chart count(clientip) by date_hour hosts usenull=f useother=f limit=0

Or else if you are actually interested in only login event, hope you are filtering the events for the same in your base search.

[zeespl]

@niketnilay, I want to create a column chart at an hour interval.

There should be columns for each host and columns to be multicolored(differnet color for each unique IP) based on count of IPs and height of column to be equal to total count.

X-axis : hosts
Y-axis : count
this should be spread across 12 hours.

[zeespl]

@niketnilay,

X-axis having 12 hours.

For each hour there should be columns corresponding to each host.

Every column should be stacked up with count of different IPs.

I hope i am clear now.

[FrankVl]

Have you tried just doing a plain | timechart span=1h dc(clientip) by hosts or something like that?

date_hour is a field that represents the hour value as splunk read it from the raw event. Not the best to use in searches really as it is not normalized.