I have some fields in my Splunk search now i want to use them to create a search query so that i can pull those information into a graph. On splunk i want to show hourly(hour field) how many d_in , d_to d_up ,err and p_to are there . Below are the field which i have
d_in = 4027
d_to = 336210
d_up = 332183
hour = 12
err = 0
p_to = 264749
d_in = 427
d_to = 3210
d_up = 2183
hour = 13
err = 2
p_to = 249
I am new in Splunk please help me in this . I am using below query to in the search to get above fields :
eventtype="abc"
@gauravepi,
Try
eventtype="abc" |fields d_in,d_to,d_up,err,p_to,hour|stats sum(*) as * by hour
@gauravepi,
Try
eventtype="abc" |fields d_in,d_to,d_up,err,p_to,hour|stats sum(*) as * by hour
Whats the expected output?
For 13 hours : Total d_in 427 if there is data-set for hour 13 having d_in = 12
Then total d_in is 427+12 = 439
So total d_in in 13th hour is 439 likewise for each field
Will there be one event for each hour value, or is it possible to have more than one event at the same hour?
Yes there will be only one event for each hour