Peak hourly volume monthly wise for last 3 months.

[Allampally]

Hi Team,

I want to calculate peak hourly volume of each month for each service. Each service can have different peak times and first need to calculate peak hour of each component for the month. Likewise calculate for last 3 months. Then calculate the average of 3 months peak hourly volume.
Below table is the sample requirement.

	January-24	February-24	March-24	Avg Volume
service1	20	50	20	30
service2	4	3	8	5
service3	20	30	40	30
service4	30000	30000	9000	23000
service5	200	300	400	300

[Allampally]

Thanks @ITWhisperer - It worked for me

[ITWhisperer]

| bin _time span=1h
| stats sum(volume) as volume by _time component
| bin _time span=1mon
| chart max(volume) as volume by component _time
| addtotals
| eval Average=Total/3

[Allampally]

What is the field used as "volume" ? Is it similar to "count" in stats to get volume ? 

I tried this but not working and tried a portion of your query 

| bin _time span=1h
| stats sum(count) as volume by _time component

Its not reporting anything under volume

[PickleRick]

Count is not the same as volume. Unless you have a synthetic field added during ingestion (or use summary indexing), you have to calculate it manually (unfortunately you cannot use tstats for that so it's gonna be costly since every single matching event has to be read and "measured")

index=whatever <your other conditions>
| eval eventlength=len(_raw)

Now you can do some summarizing

| bin _time span=1h
| stats sum(eventlength) as volume by source component whatever

This will give you one hour volumes. Now you can do with it whatever you want. Like the stats @ITWhisperer  already posted.

[ITWhisperer]

Since you didn't provide any sample events I had to guess - since you still haven't provided any sample events I can only guess whether this is right or not. Since it apparently isn't giving what you want, I would guess it isn't right. In your search, what is count? Is it a field in your events?

[Allampally]

This is the sample stats command for my log. 

index=company app=abc | stats count by component

I don't have field for volume. We have to calculate volume from the stats count. 

[ITWhisperer · Accepted solution]

| bin _time span=1h
| stats count as volume by _time component
| bin _time span=1mon
| chart max(volume) as volume by component _time
| addtotals
| eval Average=Total/3