Splunk Search

## How to get hourly stats into a graph?

Path Finder

I have some fields in my Splunk search now i want to use them to create a search query so that i can pull those information into a graph. On splunk i want to show hourly(hour field) how many d_in , d_to d_up ,err and p_to are there . Below are the field which i have

``````d_in =  4027
d_to =  336210
d_up =  332183
hour =  12
err =   0
p_to =  264749

d_in =  427
d_to =  3210
d_up =  2183
hour =  13
err =   2
p_to =  249
``````

I am new in Splunk please help me in this . I am using below query to in the search to get above fields :

``````eventtype="abc"
``````
Tags (3)
1 Solution SplunkTrust

@gauravepi,

Try

``````eventtype="abc" |fields d_in,d_to,d_up,err,p_to,hour|stats sum(*) as * by hour
`````` SplunkTrust

@gauravepi,

Try

``````eventtype="abc" |fields d_in,d_to,d_up,err,p_to,hour|stats sum(*) as * by hour
``````
Revered Legend

Whats the expected output?

Path Finder

For 13 hours : Total d_in 427 if there is data-set for hour 13 having d_in = 12
Then total d_in is 427+12 = 439
So total d_in in 13th hour is 439 likewise for each field Splunk Employee

Will there be one event for each hour value, or is it possible to have more than one event at the same hour?

Path Finder

Yes there will be only one event for each hour State of Splunk Careers