I want to create a scheduled report that would count how many log files we’ve received in last hour. This is what I’ve written:
tstats dc(source) as "source" where index=“myindex”
Its working well, but I can’t figure out how to create a chart from it. I’ve tried chart and timechart commands, but I must be doing something wrong. I want it to run against the data for last 48 hours and I want the chart to have a span of 1 hour so I can see/show how many log files Splunk is getting in that one hour.
Thank you, that's exactly what I was looking for!
My next question which I hope you can help. Would it be possible to re-write the date timestamps its giving in the output? Timestamp is like 2016-09-03T13:00:00.000. I want to re-write them so it displays just the hour for example 13:00 or 13h. In the chart you can't read the time unless you hover your mouse over a part of the chart. Thanks.