How to change my stats sum(x) search to an hourly timechart sum(y)?

[pavanae]

Hi

I have the following search which displays the sum of a field, but I am trying to put a time chart in hourly which shows the sum of that particular hour.

…..My Search……| rex "value(?<amount>\d+.\d+)" | stats count by amount |stats sum(amount) as total

How to modify my search to display the hourly count?

Any help or Suggestions?

[somesoni2]

Based on your search, it looks like you're extracting field amount, finding unique values of the field amount (first stats) and then getting total of unique amount values. If this is correct and you want to get total of unique amount values based on the hour, try this

 …..My Search……| rex "value(?<amount>\d+.\d+)" | bucket span=1h _time | stats count by _time, amount |stats sum(amount) as total by

[rphillips_splk]

index=_internal | timechart span=1h sum(count)

in your case :
…..My Search……| rex "value(?d+.d+)" | timechart span=1h sum(amount)

[hexx · Accepted solution]

I think you just want something like:

... | rex "value(?<amount>d+.d+)" | timechart span=1h sum(amount) AS "Hourly amount"

Alternatively, you could also use per_hour():

... | rex "value(?<amount>d+.d+)" | timechart span=1h per_hour(amount) AS "Hourly amount"

Both of these searches should return one result per hour reflecting the sum of the values of the "amount" field for all events within a particular hour.

[masonmorales]

Try something like:

…..My Search……| rex "value(?<amount>d+.d+)" | bin _time span=1h | timechart sum(amount) as total span=1h

or

…..My Search……| rex "value(?<amount>d+.d+)" | bin _time span=1h | stats count by amount, _time | timechart sum(amount) as total span=1h