Search results help in getting hourly results?

[kc_prane]

Hi I am using the below query and i need the results in hourly basis for the time i selected ?

"My Base search"   | fields TRAN_TIME_MS PAGE_ID PAGE_TITLE _time| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID | where TRAN_TIME_MS <= Percentile | stats count avg(TRAN_TIME_MS) as avg_time max(TRAN_TIME_MS) as max_time by PAGE_ID,PAGE_TITLE, | eval avg_time=round(avg_time/1000,2) | eval max_time=round(max_time/1000,2)
| rename count as Total_Requests avg_time as Average(Seconds) max_time as Max_Time(Seconds) PAGE_ID as Page_ID PAGE_TITLE as Page_Description

[kc_prane]

Thanks @richgalloway this Helps.

[richgalloway · Accepted solution]

To get the results broken down by hour, first use the bucket command to group results into the hour they occur.  Then add _time as a group in the stats command.

"My Base search"
| fields TRAN_TIME_MS PAGE_ID PAGE_TITLE _time
| eventstats perc99(TRAN_TIME_MS) as Percentile by PAGE_ID 
| where TRAN_TIME_MS <= Percentile 
| bucket span=1h _time
| stats count avg(TRAN_TIME_MS) as avg_time max(TRAN_TIME_MS) as max_time by _time, PAGE_ID,PAGE_TITLE, 
| eval avg_time=round(avg_time/1000,2) 
| eval max_time=round(max_time/1000,2)
| rename count as Total_Requests avg_time as Average(Seconds) max_time as Max_Time(Seconds) PAGE_ID as Page_ID PAGE_TITLE as Page_Description