https://community.splunk.com/t5/Getting-Data-In/Each-weekday-s-visitors-broken-down-by-hours/m-p/146112#M29756 <P>I can get Splunk to show me that my weekday day of fewest visitors is Saturday for the last three months. </P> <P>sourcetype=iis<BR /> | timechart span=1h dc(c_ip) as unique_ips<BR /> | eval hour_24 = strftime(_time, "%H")<BR /> | stats avg(unique_ips) by hour_24</P> <P>I can also have Splunk show me that my hour of fewest visitors is 9p for the last three months.</P> <P>sourcetype=iis<BR /> | timechart span=1d dc(c_ip) as unique_ips<BR /> | eval weekday = strftime(_time, "%w")<BR /> | stats avg(unique_ips) by weekday</P> <P>What I would like to see is what the hour of fewest visitors is on all weekdays for the last three months. Is such a chart possible in Splunk? Ideally this would display in a timechart/linegraph format.</P> <P>Any help would be appreciated in constructing the search strings. </P> Mon, 28 Sep 2020 16:29:37 GMT jason_hunsberge 2020-09-28T16:29:37Z https://community.splunk.com/t5/Getting-Data-In/Each-weekday-s-visitors-broken-down-by-hours/m-p/146112#M29756 <P>I can get Splunk to show me that my weekday day of fewest visitors is Saturday for the last three months. </P> <P>sourcetype=iis<BR /> | timechart span=1h dc(c_ip) as unique_ips<BR /> | eval hour_24 = strftime(_time, "%H")<BR /> | stats avg(unique_ips) by hour_24</P> <P>I can also have Splunk show me that my hour of fewest visitors is 9p for the last three months.</P> <P>sourcetype=iis<BR /> | timechart span=1d dc(c_ip) as unique_ips<BR /> | eval weekday = strftime(_time, "%w")<BR /> | stats avg(unique_ips) by weekday</P> <P>What I would like to see is what the hour of fewest visitors is on all weekdays for the last three months. Is such a chart possible in Splunk? Ideally this would display in a timechart/linegraph format.</P> <P>Any help would be appreciated in constructing the search strings. </P> Mon, 28 Sep 2020 16:29:37 GMT https://community.splunk.com/t5/Getting-Data-In/Each-weekday-s-visitors-broken-down-by-hours/m-p/146112#M29756 jason_hunsberge 2020-09-28T16:29:37Z https://community.splunk.com/t5/Getting-Data-In/Each-weekday-s-visitors-broken-down-by-hours/m-p/146113#M29757 <P>You can combine the two:</P> <PRE><CODE>... | timechart span=1h ... | eval hour_24 ... | eval weekday ... | stats avg(unique_ips) by weekday hour_24 </CODE></PRE> Tue, 29 Apr 2014 16:34:12 GMT https://community.splunk.com/t5/Getting-Data-In/Each-weekday-s-visitors-broken-down-by-hours/m-p/146113#M29757 martin_mueller 2014-04-29T16:34:12Z https://community.splunk.com/t5/Getting-Data-In/Each-weekday-s-visitors-broken-down-by-hours/m-p/146114#M29758 <P>perfect. thanks!</P> Tue, 29 Apr 2014 17:45:13 GMT https://community.splunk.com/t5/Getting-Data-In/Each-weekday-s-visitors-broken-down-by-hours/m-p/146114#M29758 jason_hunsberge 2014-04-29T17:45:13Z