Group event counts by hour over time

Question

I currently have a query that aggregates events over the last hour, and alerts my team if events are over a specific threshold. The query was recently accidentally disabled, and it turns out there were times when the alert should have fired but did not.

My goal is apply this alert query logic to the previous month, and determine how many times the alert would have fired, had it been functional. However, I am having a hard time figuring out how best to group these. In pseudo code I basically I would have (running over a 30 day time frame) :

  index="some_index" | where count > n | group by hour

Hopefully this makes sense, if not, I am happy to provide some clarification.

Thanks in advance

Answer 1

This should get you started:

index=foo | bin span=1h _time | stats count by _time | where count > n