Having issues w/ timecharting basic counts.

[clintla]

My base search works great for a 12 hour search

sourcetype="logs" | timechart count as eventcount by host useother = f

I've tried several variations on just getting the top couple using Top
per | top count by host

but nogo.

Would there be an easy way to say if an any hour exceeds 100 events then show the entire
12 hours for those hosts?

Even just showing where events hit over 100 for an hour for any host would be very helpful.

[sdaniels]

To do the search by hour just use the bucket command.

<your search> | bucket _time span=1h | timechart count as mycount

This will give you a table with values by host greater than 100

<your search> | bucket _time span=1h | stats count as mycount by host,_time | where mycount > 100

[clintla]

Close. My fault for not being more specific.

I'm trying to timechart out hosts that have event counts > 100.

Seems like I should be closer with the below.
| bucket _time span=1h | timechart count as mycount by host | where mycount > 100

Or is there a way to chart any host for the whole 12 hours if it gets 1 hour over 100?

| timechart per_hour(count) as mycount by host | search mycount > 100

Always an illegal search due to permissions or invalid arguement.

I'll keep tinkering- feel like Im closer- not quite there yet though.

I appreciate the help!