I have events as following
Category=a starttime="2017-11-14 05:25:22"
Category=b starttime="2017-11-14 05:29:22"
Category=b starttime="2017-11-14 04:28:18"
Category=c starttime="2017-11-14 03:22:21"
Category=a starttime="2017-11-14 06:21:28"
I want all events count by Category by hour of occurance as per starttime. _time might be completely different from starttime.
So results should say something like
Hour Category Count
5 a 1
b 1
6 b 1
@manuarora12, you can try the following:
<YourBaseSearch>
| eval _time=strptime(starttime,"%Y-%m-%d %H:%M:%S")
| timechart span=1h count by Category
What about
<your search> | rex field=starttime "\S{10}\s(?<Hour>\d\d)" | stats count by Hour, Category
Regards,
Kai.