Peak hours of the week by total daily percentage

[SecureIA]

Hi,

I need to display the peak times of day that events are occurring. Essentially, I want to find out the peak times of the week that people are logging into my web application but I want to display this by the percent of the daily total

I have my search here - host="" AND "" AND "GET" AND "" This brings the results that I need.

Any help with this would be massively appreciated.

Cheers,
Lee

[SecureIA]

Thank you so much for your reply. I'm sorry my example search was wrong.

My original search is - sourcetype=iis | eval users=cs_username | timechart span=1d dc(users)

Would this change the search string much? I have replaced count with dc(users) in the hope that it would work

[rjthibod]

I updated my original answer to reflect your search. Please respond to my answer using the "Add Comment" link below it if you have more questions or issues. Otherwise, please accept the answer if it works for you.

[rjthibod · Accepted solution]

Try this. You can change the span component to get higher or lower resolution.

sourcetype=iis
| timechart span=15m dc(cs_username) as count
| eval day = tonumber(strftime(_time,"%j")) 
| fillnull value=0 count 
| eventstats sum(count) as day_total by day 
| eval perc = round(100* (count/day_total),2) 
| fields - count day day_total

[SecureIA]

That is exactly what I needed. Thank you so much!!