How do I search for Day/Time with least amount of events?

[bamalone]

I want to find out which day of the week and time range has the least amount of traffic during the past 30 days during working hours in 3 hour groups.

The search results should return the day and time range.

Example: Monday 9am - 12pm.

Bonus points if you can help me return the top 3 results. Example: Monday 9am - 12pm, Monday 3pm - 6pm and Friday 3pm - 6pm.

[niketn]

@bamalone, try the following search for Last 30 days

| tstats count latest(_time) as Max WHERE index=_internal BY _time span=3h
| fieldformat Max=strftime(Max,"%m/%a %H:%M")
| eval Time= strftime(_time,"%m/%a")." ".strftime(_time,"%H %p")." - ".strftime(Max,"%H %p") 
| table Time count
| sort count
| head 3

PS: Replace with your index as above one is run anywhere search example with Splunk's _internal index.