https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-Day-Time-with-least-amount-of-events/m-p/375319#M160432 <P>@bamalone, try the following search for Last 30 days</P> <PRE><CODE>| tstats count latest(_time) as Max WHERE index=_internal BY _time span=3h | fieldformat Max=strftime(Max,"%m/%a %H:%M") | eval Time= strftime(_time,"%m/%a")." ".strftime(_time,"%H %p")." - ".strftime(Max,"%H %p") | table Time count | sort count | head 3 </CODE></PRE> <P>PS: Replace with your index as above one is run anywhere search example with Splunk's <STRONG>_internal</STRONG> index.</P> Mon, 03 Jul 2017 13:13:38 GMT niketn 2017-07-03T13:13:38Z https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-Day-Time-with-least-amount-of-events/m-p/375318#M160431 <P>I want to find out which day of the week and time range has the least amount of traffic during the past 30 days during working hours in 3 hour groups.</P> <P>The search results should return the day and time range.</P> <P>Example: Monday 9am - 12pm.</P> <P>Bonus points if you can help me return the top 3 results. Example: Monday 9am - 12pm, Monday 3pm - 6pm and Friday 3pm - 6pm.</P> Mon, 03 Jul 2017 08:25:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-Day-Time-with-least-amount-of-events/m-p/375318#M160431 bamalone 2017-07-03T08:25:11Z https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-Day-Time-with-least-amount-of-events/m-p/375319#M160432 <P>@bamalone, try the following search for Last 30 days</P> <PRE><CODE>| tstats count latest(_time) as Max WHERE index=_internal BY _time span=3h | fieldformat Max=strftime(Max,"%m/%a %H:%M") | eval Time= strftime(_time,"%m/%a")." ".strftime(_time,"%H %p")." - ".strftime(Max,"%H %p") | table Time count | sort count | head 3 </CODE></PRE> <P>PS: Replace with your index as above one is run anywhere search example with Splunk's <STRONG>_internal</STRONG> index.</P> Mon, 03 Jul 2017 13:13:38 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-Day-Time-with-least-amount-of-events/m-p/375319#M160432 niketn 2017-07-03T13:13:38Z