Getting Data In
Highlighted

How do I display most popular hour for user logons?

Contributor

My searchstring looks like this:
index=123 sourctype=xyz EventCode=4624 | timechart span=1h count

This gives me Logons by hour, but every hour of every day for the given range. I want it to show the logons by hour over the course of a week for example:
0100 - 2
0200 - 45
0300 - 3

It would show the logons by most popular hour for any given time range be it week, month, year, etc.

Tags (4)
0 Karma
Highlighted

Re: How do I display most popular hour for user logons?

Ultra Champion

Make use of the default-extracted fields date_* (date_hour, date_year etc)

index=blah sourcetype=bleh EventCode=1234 | stats count by date_hour

In some cases, these fields are not always extracted, but you can create them yourself;

index=blah sourcetype=bleh EventCode=1234 | eval date_hour = strftime(_time, "%H") | stats count by date_hour

Hope this helps,

K

View solution in original post

0 Karma
Highlighted

Re: How do I display most popular hour for user logons?

Contributor

That's exactly what I wanted!! Thanks!!!

0 Karma