- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this is the log data
i want a report like this:
my current query is :
index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" |eval timestamp=strftime(_time, "%F") | stats values(B2BUnknownTrxCount) by timestamp
it giving report like this:
I need to add date time in hh:mm in a chart.
Please help to update my query
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![macalamela macalamela](https://community.splunk.com/legacyfs/online/avatars/500891.jpg)
index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log"
| eval timestamp=strftime(_time, "%F"),hour=strftime(_time, "%H,%M")
| stats list(hour) as hour, list(B2BUnknownTrxCount) by timestamp
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" |eval timestamp=strftime(_time, "%Y-%m-%d %H:00") | stats values(B2BUnknownTrxCount) by timestamp
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![macalamela macalamela](https://community.splunk.com/legacyfs/online/avatars/500891.jpg)
index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log"
| eval timestamp=strftime(_time, "%F"),hour=strftime(_time, "%H,%M")
| stats list(hour) as hour, list(B2BUnknownTrxCount) by timestamp
![](/skins/images/396DDBEEAC295EB5FEC41FF128E8AC0A/responsive_peak/images/icon_anonymous_message.png)