My searchstring looks like this:
index=123 sourctype=xyz EventCode=4624 | timechart span=1h count
This gives me Logons by hour, but every hour of every day for the given range. I want it to show the logons by hour over the course of a week for example:
0100 - 2
0200 - 45
0300 - 3
It would show the logons by most popular hour for any given time range be it week, month, year, etc.
Make use of the default-extracted fields date_* (date_hour, date_year etc)
index=blah sourcetype=bleh EventCode=1234 | stats count by date_hour
In some cases, these fields are not always extracted, but you can create them yourself;
index=blah sourcetype=bleh EventCode=1234 | eval date_hour = strftime(_time, "%H") | stats count by date_hour
Hope this helps,
View solution in original post
That's exactly what I wanted!! Thanks!!!