Getting Data In

Each weekday's visitors broken down by hours

Path Finder

I can get Splunk to show me that my weekday day of fewest visitors is Saturday for the last three months.

sourcetype=iis
| timechart span=1h dc(cip) as uniqueips
| eval hour24 = strftime(time, "%H")
| stats avg(uniqueips) by hour24

I can also have Splunk show me that my hour of fewest visitors is 9p for the last three months.

sourcetype=iis
| timechart span=1d dc(cip) as uniqueips
| eval weekday = strftime(time, "%w")
| stats avg(unique
ips) by weekday

What I would like to see is what the hour of fewest visitors is on all weekdays for the last three months. Is such a chart possible in Splunk? Ideally this would display in a timechart/linegraph format.

Any help would be appreciated in constructing the search strings.

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

You can combine the two:

... | timechart span=1h ... | eval hour_24 ... | eval weekday ... | stats avg(unique_ips) by weekday hour_24

View solution in original post

SplunkTrust
SplunkTrust

You can combine the two:

... | timechart span=1h ... | eval hour_24 ... | eval weekday ... | stats avg(unique_ips) by weekday hour_24

View solution in original post

Path Finder

perfect. thanks!

0 Karma