Answers for "How to change my stats sum(x) search to an hourly timechart sum(y)?"
https://answers.splunk.com/answers/317322/how-to-change-my-stats-sumx-search-to-an-hourly-ti.html
The latest answers for the question "How to change my stats sum(x) search to an hourly timechart sum(y)?"Answer by somesoni2
https://answers.splunk.com/answering/317339/view.html
Based on your search, it looks like you're extracting field amount, finding unique values of the field amount (first stats) and then getting total of unique amount values. If this is correct and you want to get total of unique amount values based on the hour, try this
…..My Search……| rex "value(?<amount>\d+.\d+)" | bucket span=1h _time | stats count by _time, amount |stats sum(amount) as total byThu, 08 Oct 2015 18:27:21 GMTsomesoni2Answer by rphillips_splunk
https://answers.splunk.com/answering/317329/view.html
index=_internal | timechart span=1h sum(count)
in your case :
…..My Search……| rex "value(?<amount>d+.d+)" | timechart span=1h sum(amount)Thu, 08 Oct 2015 17:58:05 GMTrphillips_splunkAnswer by hexx
https://answers.splunk.com/answering/317328/view.html
I think you just want something like:
... | rex "value(?<amount>d+.d+)" | timechart span=1h sum(amount) AS "Hourly amount"
Alternatively, you could also use `per_hour()`:
... | rex "value(?<amount>d+.d+)" | timechart span=1h per_hour(amount) AS "Hourly amount"
Both of these searches should return one result per hour reflecting the sum of the values of the "amount" field for all events within a particular hour.Thu, 08 Oct 2015 17:56:31 GMThexxAnswer by masonmorales
https://answers.splunk.com/answering/317327/view.html
Try something like:
…..My Search……| rex "value(?<amount>d+.d+)" | bin _time span=1h | timechart sum(amount) as total span=1h
or
…..My Search……| rex "value(?<amount>d+.d+)" | bin _time span=1h | stats count by amount, _time | timechart sum(amount) as total span=1hThu, 08 Oct 2015 17:55:19 GMTmasonmorales