We have logs coming in from an authentication system and we would like to chart out the number of authentications by Hour of the day (or Hours of the day) for the last x number of days just to check the peak authentication times.
The query we have at the moment is
sourcetype=abc action=success | chart count(user) by date_hour
but the result is:
Hour...... Count
0............... 2
1...............12
2...............13
3...............8
......
23.............. 6
How can I get a result like:
Hour ....................Count
00:00- 00:59............2
1 :00- 1:59..............12
2:00- 2:59 ............. 13
3:00- 3:59............8
......
23:00- 23:59............ 6
Would it be possible to get a table or chart like above?
