Search code examples
splunksplunk-query

Get the count of above occurrences on an hourly basis using splunk query

When ever I receive a file I have following log.

2017-05-20T06:43:18,273+0000 LogLevel="INFO" ThreadId="[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'"ServerName="ServerName" RequestId="123456" EventCode="postData" EventMessage="Checksum validated successfully for the input file:myfileName100"

Splunk Query: index="myindex" "Checksum validated successfully for the input file:" Now I want to get the count of above occurrences on an hourly basis using splunk query. Please help

Solution

  • Try this

    index=<index-name> EventMessage="Checksum validated successfully*" | timechart count span=1h