https://community.splunk.com/t5/Splunk-Search/How-to-report-a-busiest-peak-hour-for-each-day-for-the-last-30/m-p/486728#M136129 <PRE><CODE>| makeresults count=2 | streamstats count | eval _time = if (count==2,relative_time(_time,"-30d@d"), relative_time(_time,"@d")) | makecontinuous span=1m | eval count = random() % 2 | eval value = if(count==0,"ok",NULL) | table _time value | rename COMMENT AS "this is sample data") | timechart span=1h count(value) as count | eval days = strftime(_time, "%e") | eventstats max(count) as max_count by days | chart values(eval(if(max_count==count,_time,NULL))) as max_date values(max_count) as max_count by days | fieldformat max_date=strftime(max_date,"%F %H:%M") | table max_date max_count </CODE></PRE> <P>The output values is a little different, but it would be okay.</P> Tue, 19 Nov 2019 12:19:53 GMT to4kawa 2019-11-19T12:19:53Z https://community.splunk.com/t5/Splunk-Search/How-to-report-a-busiest-peak-hour-for-each-day-for-the-last-30/m-p/486727#M136128 <P>Hi, I am trying to find the busiest time of the day for last 30 days. What i need is a table like this -</P> <P>Day PeakhourofTheDay count</P> <P>I have this query but it's not showing the peak hour in the table. Also i am not sure if it's correct. Please any help is appreciated.</P> <P>index=web_env sourcetype=ssl_access_combined <BR /> | timechart span=1h count<BR /> | timechart span=1d max(count)</P> Wed, 30 Sep 2020 03:00:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-report-a-busiest-peak-hour-for-each-day-for-the-last-30/m-p/486727#M136128 Shashank_87 2020-09-30T03:00:55Z https://community.splunk.com/t5/Splunk-Search/How-to-report-a-busiest-peak-hour-for-each-day-for-the-last-30/m-p/486728#M136129 <PRE><CODE>| makeresults count=2 | streamstats count | eval _time = if (count==2,relative_time(_time,"-30d@d"), relative_time(_time,"@d")) | makecontinuous span=1m | eval count = random() % 2 | eval value = if(count==0,"ok",NULL) | table _time value | rename COMMENT AS "this is sample data") | timechart span=1h count(value) as count | eval days = strftime(_time, "%e") | eventstats max(count) as max_count by days | chart values(eval(if(max_count==count,_time,NULL))) as max_date values(max_count) as max_count by days | fieldformat max_date=strftime(max_date,"%F %H:%M") | table max_date max_count </CODE></PRE> <P>The output values is a little different, but it would be okay.</P> Tue, 19 Nov 2019 12:19:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-report-a-busiest-peak-hour-for-each-day-for-the-last-30/m-p/486728#M136129 to4kawa 2019-11-19T12:19:53Z https://community.splunk.com/t5/Splunk-Search/How-to-report-a-busiest-peak-hour-for-each-day-for-the-last-30/m-p/486729#M136130 <P>@to4kawa thanks for the response but this is not what I am looking for and moreover this query is a bit complex and not very optimized if i have to run for a longer period.<BR /> I have shared the working query but it's just that it is not showing the peak hour along with the day. I need something like this in atabular format -</P> <P>Day PeakhourofTheDay PeakHourCount</P> Tue, 19 Nov 2019 12:26:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-report-a-busiest-peak-hour-for-each-day-for-the-last-30/m-p/486729#M136130 Shashank_87 2019-11-19T12:26:26Z https://community.splunk.com/t5/Splunk-Search/How-to-report-a-busiest-peak-hour-for-each-day-for-the-last-30/m-p/486730#M136131 <P>try rename and eval.</P> Tue, 19 Nov 2019 12:57:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-report-a-busiest-peak-hour-for-each-day-for-the-last-30/m-p/486730#M136131 to4kawa 2019-11-19T12:57:40Z