How to get hourly stats into a graph?

[gauravepi]

I have some fields in my Splunk search now i want to use them to create a search query so that i can pull those information into a graph. On splunk i want to show hourly(hour field) how many d_in , d_to d_up ,err and p_to are there . Below are the field which i have

d_in =  4027 
d_to =  336210 
d_up =  332183 
hour =  12 
err =   0 
p_to =  264749    

d_in =  427 
d_to =  3210 
d_up =  2183 
hour =  13 
err =   2 
p_to =  249

I am new in Splunk please help me in this . I am using below query to in the search to get above fields :

eventtype="abc" 

[renjith_nair · Accepted solution]

@gauravepi,

Try

eventtype="abc" |fields d_in,d_to,d_up,err,p_to,hour|stats sum(*) as * by hour

[somesoni2]

Whats the expected output?

[gauravepi]

For 13 hours : Total d_in 427 if there is data-set for hour 13 having d_in = 12
Then total d_in is 427+12 = 439
So total d_in in 13th hour is 439 likewise for each field

[kmorris_splunk]

Will there be one event for each hour value, or is it possible to have more than one event at the same hour?

[gauravepi]

Yes there will be only one event for each hour