Splunk Search

Find peak time and the number of requests

ricm
New Member

Hi,
I want to find the peak time in a day and number of requests on that peak time.
I trying to use the following but with no luck regarding the peak time.

index=servers sourcetype=web
| eval time_formatted=strftime(time,"%H:%M:%S")
| bucket time span=1s
| stats count by time
| stats max(count) as max_requests_per_second
| table max_requests_per_second time_formatted

Any idea on how to get the peak time correct?
thanks

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI @ricm ,

Can you please try this?

index=servers sourcetype=web | timechart count as requests_per_second span=1s | eventstats max(requests_per_second) as max_requests_per_second | where requests_per_second=max_requests_per_second | eval "Peak Time"=strftime(_time, "%d/%m/%Y %H:%M:%S %p")  | table "Peak Time" max_requests_per_second

Thanks

0 Karma

Sukisen1981
Champion

try this -
instead of
stats count by time|
stats max(count) as max_requests_per_second
try to get this result in one line by using eventsats
eventstats max(count) as max_requests_per_second by time

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...