Splunk Search

How to get hourly stats into a graph?

Path Finder

I have some fields in my Splunk search now i want to use them to create a search query so that i can pull those information into a graph. On splunk i want to show hourly(hour field) how many d_in , d_to d_up ,err and p_to are there . Below are the field which i have

d_in =  4027 
d_to =  336210 
d_up =  332183 
hour =  12 
err =   0 
p_to =  264749    

d_in =  427 
d_to =  3210 
d_up =  2183 
hour =  13 
err =   2 
p_to =  249

I am new in Splunk please help me in this . I am using below query to in the search to get above fields :

eventtype="abc" 
0 Karma
1 Solution

SplunkTrust
SplunkTrust

@gauravepi,

Try

eventtype="abc" |fields d_in,d_to,d_up,err,p_to,hour|stats sum(*) as * by hour

View solution in original post

SplunkTrust
SplunkTrust

@gauravepi,

Try

eventtype="abc" |fields d_in,d_to,d_up,err,p_to,hour|stats sum(*) as * by hour

View solution in original post

Revered Legend

Whats the expected output?

Path Finder

For 13 hours : Total d_in 427 if there is data-set for hour 13 having d_in = 12
Then total d_in is 427+12 = 439
So total d_in in 13th hour is 439 likewise for each field

0 Karma

Splunk Employee
Splunk Employee

Will there be one event for each hour value, or is it possible to have more than one event at the same hour?

0 Karma

Path Finder

Yes there will be only one event for each hour

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!