topic finding peak and low times from timechart in Splunk Search

finding peak and low times from timechart

kunadkat — Thu, 02 Jan 2014 14:58:27 GMT

I want to tabulate peak period and low periods for my web transactions. The following search works but not very efficient

Does anybody know better search to accomplish this?

Re: finding peak and low times from timechart

aelliott — Mon, 28 Sep 2020 15:33:50 GMT

There's a max, min stats functions that may help you:

(your search)
| stats max(count) AS max min(count) AS min
| table min max

This one should work pretty well as I have tested it and verified :
index=web GET OR POST | bucket _time span=1h |stats count by _time | eventstats max(count) AS max_count min(count) AS min_count by _time | timechart max(max_count),min(min_count)

and a more simplified version:
index=web GET OR POST | bucket _time span=1h |stats count by _time | timechart max(count),min(count)

since the max and min in a given hour is exactly the same

Re: finding peak and low times from timechart

kunadkat — Thu, 02 Jan 2014 15:27:45 GMT

Thanks for your quick response, but I am interested in finding Peak and low time periods and not the count values. The above search gives be max and min counts only

Re: finding peak and low times from timechart

dwaddle — Thu, 02 Jan 2014 15:35:31 GMT

Do you want to simply know what the lowest and highest values were? Or what they were and when they occurred?

If you simply want to know what the highest and lowest values were, then aelliot is absolutely correct. This search is what he suggested with the "(your search)" part included literally.

index=web GET OR POST | timechart span=1h count 
| stats max(count) as max, min(count) as min
| table min,max

Something else that might work is this:

index=web GET OR POST | timechart span=1h count 
| eventstats max(count) as high, min(count) as low
| where (count=low OR count=high)
| fields _time, count

You get the high and low, and when they occurred.

If neither of these are what you want, and if you cannot come up with something that works for you as a variation on one of these then perhaps you'll need to describe your actual request a little more verbosely.

Re: finding peak and low times from timechart

aelliott — Thu, 02 Jan 2014 15:40:42 GMT

You may find this post helpful as well (I believe dwaddle has something similar within his answer)
http://answers.splunk.com/answers/55271/report-hourly-max-count-events-per-day-over-a-month

Re: finding peak and low times from timechart

kunadkat — Thu, 02 Jan 2014 19:36:23 GMT

The second search is what I am looking for and it works Thanks,