Splunk Search

How to report a busiest/peak hour for each day for the last 30 days?

Shashank_87
Explorer

Hi, I am trying to find the busiest time of the day for last 30 days. What i need is a table like this -

Day PeakhourofTheDay count

I have this query but it's not showing the peak hour in the table. Also i am not sure if it's correct. Please any help is appreciated.

index=web_env sourcetype=ssl_access_combined
| timechart span=1h count
| timechart span=1d max(count)

0 Karma

to4kawa
Ultra Champion
| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-30d@d"), relative_time(_time,"@d"))
| makecontinuous span=1m
| eval count = random() % 2
| eval value = if(count==0,"ok",NULL)
| table _time value
| rename COMMENT AS "this is sample data")
| timechart span=1h count(value) as count
| eval days = strftime(_time, "%e")
| eventstats max(count) as max_count by days
| chart values(eval(if(max_count==count,_time,NULL))) as max_date values(max_count) as max_count by days
| fieldformat max_date=strftime(max_date,"%F %H:%M")
| table max_date max_count

The output values is a little different, but it would be okay.

0 Karma

Shashank_87
Explorer

@to4kawa thanks for the response but this is not what I am looking for and moreover this query is a bit complex and not very optimized if i have to run for a longer period.
I have shared the working query but it's just that it is not showing the peak hour along with the day. I need something like this in atabular format -

Day PeakhourofTheDay PeakHourCount

0 Karma

to4kawa
Ultra Champion

try rename and eval.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...