https://community.splunk.com/t5/Splunk-Search/How-to-find-peak-time-and-the-low-time-of-the-requests-with-the/m-p/414149#M169295 <P>@jconger small typo... <CODE>| http_status=200</CODE> should be without pipe to add filter in the base search.</P> Tue, 22 May 2018 17:11:07 GMT niketn 2018-05-22T17:11:07Z https://community.splunk.com/t5/Splunk-Search/How-to-find-peak-time-and-the-low-time-of-the-requests-with-the/m-p/414147#M169293 <P>Hi Team,<BR /> I like to find the peak time of the success requests (http_status=200) and also the least time of the requests (http_status=200) with the span of 1 hr. For example, if i search the web access log query for last 24 hours, it should be display 11 AM (PEAK TIME) and 9 PM (LEAST TIME) of the successful requests and also it should display the number of requests in the 11 AM, 9 PM span. please help</P> Tue, 29 Sep 2020 19:39:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-peak-time-and-the-low-time-of-the-requests-with-the/m-p/414147#M169293 balamv 2020-09-29T19:39:42Z https://community.splunk.com/t5/Splunk-Search/How-to-find-peak-time-and-the-low-time-of-the-requests-with-the/m-p/414148#M169294 <P>Something like this may work:</P> <PRE><CODE>index=YOUR_INDEX sourcetype=YOUR_SOURCETYPE earliest=-24h@h latest=now http_status=200 | stats count by date_hour | eventstats max(count) as max min(count) as min | where count=max OR count=min | fields - max min </CODE></PRE> <P>Here is an example using the _internal index:</P> <PRE><CODE>index=_internal earliest=-24h@h latest=now | stats count by date_hour | eventstats max(count) as max min(count) as min | where count=max OR count=min | fields - max min </CODE></PRE> <P>Resulting output from the above search:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5015i1DCC4F32CEA51E2A/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 22 May 2018 16:52:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-peak-time-and-the-low-time-of-the-requests-with-the/m-p/414148#M169294 jconger 2018-05-22T16:52:58Z https://community.splunk.com/t5/Splunk-Search/How-to-find-peak-time-and-the-low-time-of-the-requests-with-the/m-p/414149#M169295 <P>@jconger small typo... <CODE>| http_status=200</CODE> should be without pipe to add filter in the base search.</P> Tue, 22 May 2018 17:11:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-peak-time-and-the-low-time-of-the-requests-with-the/m-p/414149#M169295 niketn 2018-05-22T17:11:07Z https://community.splunk.com/t5/Splunk-Search/How-to-find-peak-time-and-the-low-time-of-the-requests-with-the/m-p/414150#M169296 <P>@niketnilay noted and corrected - thanks!</P> Tue, 22 May 2018 18:05:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-peak-time-and-the-low-time-of-the-requests-with-the/m-p/414150#M169296 jconger 2018-05-22T18:05:51Z