How to find peak time and the low time of the requests with the span of every hour?

[balamv]

Hi Team,
I like to find the peak time of the success requests (http_status=200) and also the least time of the requests (http_status=200) with the span of 1 hr. For example, if i search the web access log query for last 24 hours, it should be display 11 AM (PEAK TIME) and 9 PM (LEAST TIME) of the successful requests and also it should display the number of requests in the 11 AM, 9 PM span. please help

[jconger]

Something like this may work:

index=YOUR_INDEX sourcetype=YOUR_SOURCETYPE earliest=-24h@h latest=now http_status=200 | stats count by date_hour | eventstats max(count) as max min(count) as min | where count=max OR count=min | fields - max min

Here is an example using the _internal index:

index=_internal earliest=-24h@h latest=now | stats count by date_hour | eventstats max(count) as max min(count) as min | where count=max OR count=min | fields - max min

Resulting output from the above search:

[niketn]

@jconger small typo... | http_status=200 should be without pipe to add filter in the base search.

[jconger]

@niketnilay noted and corrected - thanks!