Splunk Search

How to report a busiest/peak hour for each day for the last 30 days?

Shashank_87
Explorer

Hi, I am trying to find the busiest time of the day for last 30 days. What i need is a table like this -

Day PeakhourofTheDay count

I have this query but it's not showing the peak hour in the table. Also i am not sure if it's correct. Please any help is appreciated.

index=web_env sourcetype=ssl_access_combined
| timechart span=1h count
| timechart span=1d max(count)

0 Karma

to4kawa
Ultra Champion
| makeresults count=2
| streamstats count
| eval _time = if (count==2,relative_time(_time,"-30d@d"), relative_time(_time,"@d"))
| makecontinuous span=1m
| eval count = random() % 2
| eval value = if(count==0,"ok",NULL)
| table _time value
| rename COMMENT AS "this is sample data")
| timechart span=1h count(value) as count
| eval days = strftime(_time, "%e")
| eventstats max(count) as max_count by days
| chart values(eval(if(max_count==count,_time,NULL))) as max_date values(max_count) as max_count by days
| fieldformat max_date=strftime(max_date,"%F %H:%M")
| table max_date max_count

The output values is a little different, but it would be okay.

0 Karma

Shashank_87
Explorer

@to4kawa thanks for the response but this is not what I am looking for and moreover this query is a bit complex and not very optimized if i have to run for a longer period.
I have shared the working query but it's just that it is not showing the peak hour along with the day. I need something like this in atabular format -

Day PeakhourofTheDay PeakHourCount

0 Karma

to4kawa
Ultra Champion

try rename and eval.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...