hi all, in my original search im getting data by folloing command: | stats range(_time) as timetaken by CorrelationID| stats count as Total, avg(timetaken) as AvgResponseTime, perc95(timetaken) as P95ResponseTime but now, i want this data on hourly basis. so i tried the following script: |bin _time span=1d |eval Time=strftime(_time , "%d/%m/%Y %H:%M")| stats range(_time) as timetaken by CorrelationID| stats count as Total, avg(timetaken) as AvgResponseTime, perc95(timetaken) as P95ResponseTime by Time but this gives me 0 value. i'm seeking for the right way to get data on hourly basis.
... View more