Splunk Search

Peak hourly volume monthly wise for last 3 months.

Allampally
Path Finder

Hi Team,

I want to calculate peak hourly volume of each month for each service. Each service can have different peak times and first need to calculate peak hour of each component for the month. Likewise calculate for last 3 months. Then calculate the average of 3 months peak hourly volume.
Below table is the sample requirement.

 January-24February-24March-24Avg Volume
service120502030
service24385
service320304030
service43000030000900023000
service5200300400300
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1h
| stats count as volume by _time component
| bin _time span=1mon
| chart max(volume) as volume by component _time
| addtotals
| eval Average=Total/3

View solution in original post

Allampally
Path Finder

Thanks @ITWhisperer - It worked for me

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1h
| stats sum(volume) as volume by _time component
| bin _time span=1mon
| chart max(volume) as volume by component _time
| addtotals
| eval Average=Total/3
0 Karma

Allampally
Path Finder

 

What is the field used as "volume" ? Is it similar to "count" in stats to get volume ? 

I tried this but not working and tried a portion of your query 

| bin _time span=1h
| stats sum(count) as volume by _time component

Its not reporting anything under volume

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Count is not the same as volume. Unless you have a synthetic field added during ingestion (or use summary indexing), you have to calculate it manually (unfortunately you cannot use tstats for that so it's gonna be costly since every single matching event has to be read and "measured")

index=whatever <your other conditions>
| eval eventlength=len(_raw)

Now you can do some summarizing

| bin _time span=1h
| stats sum(eventlength) as volume by source component whatever

This will give you one hour volumes. Now you can do with it whatever you want. Like the stats @ITWhisperer  already posted.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Since you didn't provide any sample events I had to guess - since you still haven't provided any sample events I can only guess whether this is right or not. Since it apparently isn't giving what you want, I would guess it isn't right. In your search, what is count? Is it a field in your events?

0 Karma

Allampally
Path Finder

This is the sample stats command for my log. 

index=company app=abc | stats count by component

I don't have field for volume. We have to calculate volume from the stats count. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1h
| stats count as volume by _time component
| bin _time span=1mon
| chart max(volume) as volume by component _time
| addtotals
| eval Average=Total/3
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...