Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to change my stats sum(x) search to an hourly ...

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

pavanae

Builder

10-08-2015
10:42 AM

Hi

I have the following search which displays the sum of a field, but I am trying to put a time chart in hourly which shows the sum of that particular hour.

```
…..My Search……| rex "value(?<amount>\d+.\d+)" | stats count by amount |stats sum(amount) as total
```

How to modify my search to display the hourly count?

Any help or Suggestions?

1 Solution

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to change my stats sum(x) search to an hourly timechart sum(y)?

masonmorales

Influencer

10-08-2015
10:55 AM

Try something like:

```
…..My Search……| rex "value(?<amount>d+.d+)" | bin _time span=1h | timechart sum(amount) as total span=1h
```

or

```
…..My Search……| rex "value(?<amount>d+.d+)" | bin _time span=1h | stats count by amount, _time | timechart sum(amount) as total span=1h
```

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

hexx

Splunk Employee

10-08-2015
10:56 AM

I think you just want something like:

```
... | rex "value(?<amount>d+.d+)" | timechart span=1h sum(amount) AS "Hourly amount"
```

Alternatively, you could also use `per_hour()`

:

```
... | rex "value(?<amount>d+.d+)" | timechart span=1h per_hour(amount) AS "Hourly amount"
```

Both of these searches should return one result per hour reflecting the sum of the values of the "amount" field for all events within a particular hour.

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to change my stats sum(x) search to an hourly timechart sum(y)?

rphillips_splun

Splunk Employee

10-08-2015
10:58 AM

index=_internal | timechart span=1h sum(count)

in your case :

…..My Search……| rex "value(?

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How to change my stats sum(x) search to an hourly timechart sum(y)?

somesoni2

SplunkTrust

10-08-2015
11:27 AM

Based on your search, it looks like you're extracting field amount, finding unique values of the field amount (first stats) and then getting total of unique amount values. If this is correct and you want to get total of unique amount values based on the hour, try this

```
…..My Search……| rex "value(?<amount>\d+.\d+)" | bucket span=1h _time | stats count by _time, amount |stats sum(amount) as total by
```