It's showing all the hours for each day but groups all activity at midnight of each day instead of through the day. This is my output query -
| timechart span=1hour count by PlatformName limit=50
How do I get the breakdown for each hour in the day to show?
If you've configured the saved search populating the summary index to run only once a day, (and the rows you're sending into the summary index don't have _time values), then the summary will only ever have events at midnight on each day, and that will be your problem here.
it's important when setting up summary indexing to use a time interval that will be able to give you the granularity that you need.
Excerpt from that page: "Remember that searches that populate summary indexes should run on a fairly frequent basis in order to create statistically accurate final reports. If the search you're running against the summary index is gathering information for the past week, you should have the summary search run on an hourly basis, collecting information for each hour. If you're running searches over the past year's worth of data, you might have the summary index collect data on a daily basis for the past day."
If you're running the summary index search at midnight because the system is generally underutilized then, and say your search was like
... | stats count by username, then there's another way to up the granularity of summary data from one day to one hour, by changing the search to this:
... | bin _time span="1h" | stats count by username, _time
Even if you only run that once a day, the rows it's sending into the summary index have a _time field, and unless you've spceially configured your SI config, it'll use that _time field when it creates the new rows, meaning that you can have 1-hour granularity on your timecharts later.
Pardon, I'm very new to Splunk. This is the full query -
index="summary" search_name="si_http_programID_platform_format" earliest="-7day@day" latest="-0day@day" | timechart span=1hour count by PlatformName limit=50