Splunk Search

How to find peak time and the low time of the requests with the span of every hour?

balamv
Engager

Hi Team,
I like to find the peak time of the success requests (http_status=200) and also the least time of the requests (http_status=200) with the span of 1 hr. For example, if i search the web access log query for last 24 hours, it should be display 11 AM (PEAK TIME) and 9 PM (LEAST TIME) of the successful requests and also it should display the number of requests in the 11 AM, 9 PM span. please help

Tags (1)
0 Karma

jconger
Splunk Employee
Splunk Employee

Something like this may work:

index=YOUR_INDEX sourcetype=YOUR_SOURCETYPE earliest=-24h@h latest=now http_status=200 | stats count by date_hour | eventstats max(count) as max min(count) as min | where count=max OR count=min | fields - max min

Here is an example using the _internal index:

index=_internal earliest=-24h@h latest=now | stats count by date_hour | eventstats max(count) as max min(count) as min | where count=max OR count=min | fields - max min

Resulting output from the above search:

alt text

niketn
Legend

@jconger small typo... | http_status=200 should be without pipe to add filter in the base search.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jconger
Splunk Employee
Splunk Employee

@niketnilay noted and corrected - thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...