Reputation: 799
I am trying to fetch the results based on Splunk search for every hour in a day. I want to add the timestamp in the results. I'm expecting 24 rows in the result each row is considered as one hour data with timestamp mentioned in each row per day.
My basic query:
index = 'xyz' sourcetype='abc' status='completed'
How can I modifying the query in the below format?
time status
1am completed
2am completed
.. ...
11pm completed
Upvotes: 0
Views: 1995