topic Re: How do I display most popular hour for user logons? in Getting Data In

How do I display most popular hour for user logons?

hagjos43 — Fri, 24 Jan 2014 14:45:59 GMT

My searchstring looks like this:
index=123 sourctype=xyz EventCode=4624 | timechart span=1h count

This gives me Logons by hour, but every hour of every day for the given range. I want it to show the logons by hour over the course of a week for example:
0100 - 2
0200 - 45
0300 - 3

It would show the logons by most popular hour for any given time range be it week, month, year, etc.

Re: How do I display most popular hour for user logons?

kristian_kolb — Fri, 24 Jan 2014 14:59:28 GMT

Make use of the default-extracted fields date_* (date_hour, date_year etc)

index=blah sourcetype=bleh EventCode=1234 | stats count by date_hour

In some cases, these fields are not always extracted, but you can create them yourself;

index=blah sourcetype=bleh EventCode=1234 | eval date_hour = strftime(_time, "%H") | stats count by date_hour

Hope this helps,

Re: How do I display most popular hour for user logons?

hagjos43 — Fri, 24 Jan 2014 15:31:39 GMT

That's exactly what I wanted!! Thanks!!!