Hi, I am new to Splunk and working with parking records. Within my events, I have a permit_expiry field, which is a date and time a few or so hours after the initial data timestamp.
How do I display the number of permit_expiry which are occurring within the hour. I understand there is the now() function which holds the current time, but am unsure how to utilise it.
My draft search is below, but I know there is something missing within the "now() + 1 hour".
sourcetype="parking_log"
| where permit_expiry < now() + 1 hour
| stats count by permit_expiry
Many thanks!
