topic Peak hours of the week by total daily percentage in Splunk Search

Peak hours of the week by total daily percentage

SecureIA — Wed, 08 Mar 2017 11:09:50 GMT

Hi,

I need to display the peak times of day that events are occurring. Essentially, I want to find out the peak times of the week that people are logging into my web application but I want to display this by the percent of the daily total

I have my search here - host="" AND "" AND "GET" AND "" This brings the results that I need.

Any help with this would be massively appreciated.

Cheers,
Lee

Re: Peak hours of the week by total daily percentage

rjthibod — Wed, 08 Mar 2017 11:23:34 GMT

Try this. You can change the span component to get higher or lower resolution.

sourcetype=iis
| timechart span=15m dc(cs_username) as count
| eval day = tonumber(strftime(_time,"%j")) 
| fillnull value=0 count 
| eventstats sum(count) as day_total by day 
| eval perc = round(100* (count/day_total),2) 
| fields - count day day_total

Re: Peak hours of the week by total daily percentage

SecureIA — Wed, 08 Mar 2017 11:37:38 GMT

Thank you so much for your reply. I'm sorry my example search was wrong.

My original search is - sourcetype=iis | eval users=cs_username | timechart span=1d dc(users)

Would this change the search string much? I have replaced count with dc(users) in the hope that it would work

Re: Peak hours of the week by total daily percentage

rjthibod — Wed, 08 Mar 2017 11:51:41 GMT

I updated my original answer to reflect your search. Please respond to my answer using the "Add Comment" link below it if you have more questions or issues. Otherwise, please accept the answer if it works for you.

Re: Peak hours of the week by total daily percentage

SecureIA — Wed, 08 Mar 2017 12:03:47 GMT

That is exactly what I needed. Thank you so much!!