Count number of Transaction every hour

[thinksplunk]

2013-09-20 16:53:04,723 INFO[Thread-3]EndTime=20/09/2013 16:53:04 TransactionID=A, Event=completed, Result=sent
2013-09-20 16:03:04,723 INFO[Thread-3]EndTime=20/09/2013 16:53:04 TransactionID=b, Event=completed, Result=sent
2013-09-20 13:52:04,723 INFO[Thread-3]StartTime=20/09/2013 16:52:04 TransactionID=Ab, Event=start_process
2013-09-20 09:52:04,723 INFO[Thread-3]StartTime=20/09/2013 16:52:04 TransactionID=Ab, Event=start_process

If i need to get the # of transaction every hour as belows, what would be the search statement?
Date Transaction count
2013-09-20 09 1
2013-09-20 13 1
2013-09-20 16 2

[somesoni2]

Another method (which is more accurate then bucket) is as below:-

sourcetype=TranData | eval Date=strftime(_time,"%Y-%m-%d %H") | stats count as "Transaction Count" by Date

Problem with bucket is that if the query is executed in first 30 min, the base time to calculate may become :30.

[kristian_kolb]

Given your sample data, what you are talking about are not transactions in splunkese, but rather simple events. The following will present a table that is quite near what you are looking for.

... | bucket _time span=1h | stats count AS "Transaction Count" by _time

/Kristian