https://community.splunk.com/t5/Splunk-Search/How-to-display-the-time-in-time/m-p/325602#M161372 <P>Thank you!</P> Thu, 13 Apr 2017 06:33:16 GMT nive00 2017-04-13T06:33:16Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-time-in-time/m-p/325600#M161370 <P>I need to display the maximum count of users logged in per day (at what time).</P> <P>I am able to get the max user count from below query. but I am not sure on how to get the time at which maximo user's were logged in.</P> <PRE><CODE>index=hwm_* sourcetype=was:maximo:sysout UID=* OR uid=* asset_env=PROD | eval username=coalesce(UID,uid) | timechart span=1h dc(username) as usercount | timechart span=1d max(usercount) </CODE></PRE> Wed, 12 Apr 2017 10:22:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-time-in-time/m-p/325600#M161370 nive00 2017-04-12T10:22:01Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-time-in-time/m-p/325601#M161371 <P>If you want the maximum number of users attempting to login in an hour per day plus the hour that maximum occurred in, try this:</P> <PRE><CODE> index=hwm_* sourcetype=was:maximo:sysout UID=* OR uid=* asset_env=PROD | eval username=coalesce(UID,uid) | bin _time span=1h | stats dc(username) as users by _time | bin _time as day span=1d | eventstats max(users) as max by day | where users=max | fields - day max </CODE></PRE> <P>Note, this will yield multiple hours per day if the maximum occurs multiple times that day.</P> Wed, 12 Apr 2017 12:15:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-time-in-time/m-p/325601#M161371 martin_mueller 2017-04-12T12:15:05Z https://community.splunk.com/t5/Splunk-Search/How-to-display-the-time-in-time/m-p/325602#M161372 <P>Thank you!</P> Thu, 13 Apr 2017 06:33:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-display-the-time-in-time/m-p/325602#M161372 nive00 2017-04-13T06:33:16Z