Splunk Search

How to edit my search to find the time frame window with the least amount of events?

bamalone
New Member

Hi there,

I am trying to return the top 3 results of three hour windows where an event is least likely to happen based on the past 30 days during working hours (Monday - Friday 9am - 5pm).

So far I have

event name here
 | eval day_of_week = strftime(_time,"%A")
 | where NOT (day_of_week="Saturday" OR day_of_week="Sunday")
 | bin span=1d _time
 | stats count dc(_time) as days by day_of_week
 | eval average_count = count / days
 | eventstats avg(average_count)
 | sort Average_Count | head 3
 | fields day_of_week, count

I am looking to return something like:
Example: Monday 9am - 12pm, Monday 2pm - 5pm and Friday 2pm - 5pm.

An ideas how to improve my search and return what I am looking for? Cheers

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

your base search
| eval day_of_week = strftime(_time,"%A")
| eval hour=strftime(_time,"%H")
| where NOT (day_of_week="Saturday" OR day_of_week="Sunday") AND (hour>=9 AND hour<17)
| eval period=case(hour>=9 AND hour<12,"9 AM to 12 PM",hour>=12 AND hour<14,"12 PM to 2 PM",1=1,"2 PM to 5 PM")
| bin span=1d _time
| stats count dc(_time) as days by day_of_week period
| eval average_count = count/days
| sort 3 average_count
| eval day_of_week, period, count
0 Karma

bamalone
New Member

Thanks so much.

However, I would like to return the top 3 x 3 hour time slots with the least amount of events not specific to line 5 in your suggestion.

Something like this instead:

 your base search
 | eval day_of_week = strftime(_time,"%A")
 | eval time= strftime(_time,"%m/%a")." ".strftime(_time,"%H %p")." - ".strftime(Max,"%H %p") 
 | fieldformat Max=strftime(Max,"%m/%a %H:%M")
 | tstats count latest(_time) as Max WHERE index=_internal BY _time span=3h
 | where NOT (day_of_week="Saturday" OR day_of_week="Sunday") AND (hour>=9 AND hour<17)
 | stats count dc(_time) as days by day_of_week period
 | eval average_count = count/days
 | sort 3 average_count
 | fields day_of_week, period, count

However, the above does not seem to work, can you help me out? Cheers

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...