https://community.splunk.com/t5/Splunk-Search/Using-timechart-to-show-the-number-of-users-in-the-busiest/m-p/675749#M231176 <P>Hi,</P><P>I'm after some assistance.</P><P>I am trying to capture the peak number of concurrent users in a single minute block using timecharts.&nbsp; I can do this one minute blocks no problem.&nbsp;&nbsp;</P><P>Where this gets complicated is that I have been given the requirement that I should be able to change the timechart span from 1m to 1h and identify the peak minute with the highest number of users within each hour (if hour selected) and display the number of users for that peak minute (frather than the peak number of users for that hour).</P><P>Can anyone assist me with this, or advise if it's even possible?</P><P>Thanks</P> Mon, 29 Jan 2024 11:03:50 GMT SleepyGuy 2024-01-29T11:03:50Z https://community.splunk.com/t5/Splunk-Search/Using-timechart-to-show-the-number-of-users-in-the-busiest/m-p/675749#M231176 <P>Hi,</P><P>I'm after some assistance.</P><P>I am trying to capture the peak number of concurrent users in a single minute block using timecharts.&nbsp; I can do this one minute blocks no problem.&nbsp;&nbsp;</P><P>Where this gets complicated is that I have been given the requirement that I should be able to change the timechart span from 1m to 1h and identify the peak minute with the highest number of users within each hour (if hour selected) and display the number of users for that peak minute (frather than the peak number of users for that hour).</P><P>Can anyone assist me with this, or advise if it's even possible?</P><P>Thanks</P> Mon, 29 Jan 2024 11:03:50 GMT https://community.splunk.com/t5/Splunk-Search/Using-timechart-to-show-the-number-of-users-in-the-busiest/m-p/675749#M231176 SleepyGuy 2024-01-29T11:03:50Z https://community.splunk.com/t5/Splunk-Search/Using-timechart-to-show-the-number-of-users-in-the-busiest/m-p/675751#M231177 <P>Assuming you have a count per minute, you can add another timechart command</P><LI-CODE lang="markup">| timechart span=1h max(count) as peak_per_minute</LI-CODE> Mon, 29 Jan 2024 12:11:04 GMT https://community.splunk.com/t5/Splunk-Search/Using-timechart-to-show-the-number-of-users-in-the-busiest/m-p/675751#M231177 ITWhisperer 2024-01-29T12:11:04Z https://community.splunk.com/t5/Splunk-Search/Using-timechart-to-show-the-number-of-users-in-the-busiest/m-p/675752#M231178 <P>Thanks, I hadn't considered that.&nbsp; I'll give that a try.</P> Mon, 29 Jan 2024 12:29:58 GMT https://community.splunk.com/t5/Splunk-Search/Using-timechart-to-show-the-number-of-users-in-the-busiest/m-p/675752#M231178 SleepyGuy 2024-01-29T12:29:58Z https://community.splunk.com/t5/Splunk-Search/Using-timechart-to-show-the-number-of-users-in-the-busiest/m-p/675753#M231179 <P>Thanks, I hadn't considered that. I'll give that a try.</P> Mon, 29 Jan 2024 12:30:24 GMT https://community.splunk.com/t5/Splunk-Search/Using-timechart-to-show-the-number-of-users-in-the-busiest/m-p/675753#M231179 SleepyGuy 2024-01-29T12:30:24Z