topic Re: Peak hourly volume monthly wise for last 3 months. in Splunk Search

Peak hourly volume monthly wise for last 3 months.

Allampally — Sat, 09 Mar 2024 14:25:25 GMT

Hi Team,

I want to calculate peak hourly volume of each month for each service. Each service can have different peak times and first need to calculate peak hour of each component for the month. Likewise calculate for last 3 months. Then calculate the average of 3 months peak hourly volume.
Below table is the sample requirement.

	January-24	February-24	March-24	Avg Volume
service1	20	50	20	30
service2	4	3	8	5
service3	20	30	40	30
service4	30000	30000	9000	23000
service5	200	300	400	300

Re: Peak hourly volume monthly wise for last 3 months.

ITWhisperer — Sat, 09 Mar 2024 15:30:42 GMT

Re: Peak hourly volume monthly wise for last 3 months.

Allampally — Sat, 09 Mar 2024 16:17:03 GMT

What is the field used as "volume" ? Is it similar to "count" in stats to get volume ?

I tried this but not working and tried a portion of your query

| bin _time span=1h
| stats sum(count) as volume by _time component

Its not reporting anything under volume

Re: Peak hourly volume monthly wise for last 3 months.

ITWhisperer — Sat, 09 Mar 2024 16:20:30 GMT

Since you didn't provide any sample events I had to guess - since you still haven't provided any sample events I can only guess whether this is right or not. Since it apparently isn't giving what you want, I would guess it isn't right. In your search, what is count? Is it a field in your events?

Re: Peak hourly volume monthly wise for last 3 months.

Allampally — Sat, 09 Mar 2024 16:46:45 GMT

This is the sample stats command for my log.

index=company app=abc | stats count by component

I don't have field for volume. We have to calculate volume from the stats count.

Re: Peak hourly volume monthly wise for last 3 months.

PickleRick — Sat, 09 Mar 2024 23:07:10 GMT

Count is not the same as volume. Unless you have a synthetic field added during ingestion (or use summary indexing), you have to calculate it manually (unfortunately you cannot use tstats for that so it's gonna be costly since every single matching event has to be read and "measured")

index=whatever <your other conditions>
| eval eventlength=len(_raw)

Now you can do some summarizing

| bin _time span=1h
| stats sum(eventlength) as volume by source component whatever

This will give you one hour volumes. Now you can do with it whatever you want. Like the stats @ITWhisperer already posted.

Re: Peak hourly volume monthly wise for last 3 months.

ITWhisperer — Sun, 10 Mar 2024 09:08:47 GMT

Re: Peak hourly volume monthly wise for last 3 months.

Allampally — Mon, 11 Mar 2024 13:59:33 GMT

Thanks @ITWhisperer - It worked for me