Splunk Search

How to report a peak count per day based on a per minute count?

karlduncans
Engager

I'm trying to determine a way to report a peak per minute count per day (in this case, the last 30 days)

If i run this for a full 24 hour day, i get the peak for that one day:

index=foo source=bar
| bucket span=1m _time
| stats count by _time
| sort -count
| head 1

But if i run this for the last 5 days, i'll just get a single per minute peak for the total 5 day period, and what i need is the per-day peak tabled.

My ultimate goal in the end would be to average that 30d per minute peak, but that might need to be done in a separate search.

Thank you in advance!

Tags (2)
0 Karma
1 Solution

allanw_splunk
Splunk Employee
Splunk Employee

Try this:

index=foo source=bar | timechart span=1m count | timechart span=1d max(count). This will give you the max count per minute for each day.

View solution in original post

ppablo
Retired

Hi @karlduncans

Just wanted to follow up with this post. Did @allanw_splunk's answer below solve your question? If yes, don't forget to officially accept it by clicking on "Accept" directly below his answer and also upvote it by clicking on the up arrow to the left of the answer.

0 Karma

allanw_splunk
Splunk Employee
Splunk Employee

Try this:

index=foo source=bar | timechart span=1m count | timechart span=1d max(count). This will give you the max count per minute for each day.

Vebloud
Explorer

Is there a way how to get also a minute in which maximum happened? I am struggling to even come with and idea how to get it there.

0 Karma

Shashank_87
Explorer

@Vebloud @allanw_splunk - Are you able to figure it out how to add the minute in the table. I am also facing the same problem and wanting to know if you have figured out any solution for this

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...