How to find sum of particular fields by time?

[pal_sumit1]

We are having search which contain two fields user id and time at which user logged in.

We need to print below table

Time--------------|--------total user (no. of user logged in that hour)
00:00--1:00 am|---30
01:00--2:00 am|---40
etc..
we have to print top 10 values for current day only.
IF we are running search today it should show only today data.
and if we are running search tomorrow that it should show only tomorrow data

[somesoni2 · Accepted solution]

Give this a try (assuming your logged in time is identified your _time of the event)

Your search which contain two fields user id and time
| timechart span=1h dc(userId) as "Total Users"
| eval Time=strftime(_time,"%H:%M")."--".strftime(_time+3600,"%H:%M")
| table Time "Total Users"

[kmaron]

(search for logins) 
| bucket _time span=1h
| stats count by _time
| sort - count limit=10

If you separate them into 1 hour buckets it will get you the per hour count then take the top 10 values.
You can either set the time picker to "today" or set earliest=@d to start at the beginning of today

[David_Naylor]

Hello,

The following should get you what your looking for

Basesearch | timechart DC(userid) span=1h