Splunk Search

## How to report a peak count per day based on a per minute count?

Engager

I'm trying to determine a way to report a peak per minute count per day (in this case, the last 30 days)

If i run this for a full 24 hour day, i get the peak for that one day:

index=foo source=bar
| bucket span=1m _time
| stats count by _time
| sort -count

But if i run this for the last 5 days, i'll just get a single per minute peak for the total 5 day period, and what i need is the per-day peak tabled.

My ultimate goal in the end would be to average that 30d per minute peak, but that might need to be done in a separate search.

Tags (2)
1 Solution
Splunk Employee

Try this:

index=foo source=bar | timechart span=1m count | timechart span=1d max(count). This will give you the max count per minute for each day.

Retired

Hi @karlduncans

Just wanted to follow up with this post. Did @allanw_splunk's answer below solve your question? If yes, don't forget to officially accept it by clicking on "Accept" directly below his answer and also upvote it by clicking on the up arrow to the left of the answer.

Splunk Employee

Try this:

index=foo source=bar | timechart span=1m count | timechart span=1d max(count). This will give you the max count per minute for each day.

Explorer

Is there a way how to get also a minute in which maximum happened? I am struggling to even come with and idea how to get it there.

Explorer

@Vebloud @allanw_splunk - Are you able to figure it out how to add the minute in the table. I am also facing the same problem and wanting to know if you have figured out any solution for this

Get Updates on the Splunk Community!

#### Adoption of RUM and APM at Splunk

Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

#### March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

#### Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...