Splunk Search

Peak hours of the week by total daily percentage

Path Finder

Hi,

I need to display the peak times of day that events are occurring. Essentially, I want to find out the peak times of the week that people are logging into my web application but I want to display this by the percent of the daily total

I have my search here - host="" AND "" AND "GET" AND "" This brings the results that I need.

Any help with this would be massively appreciated.

Cheers,
Lee

0 Karma
1 Solution

Champion

Try this. You can change the span component to get higher or lower resolution.

sourcetype=iis
| timechart span=15m dc(cs_username) as count
| eval day = tonumber(strftime(_time,"%j")) 
| fillnull value=0 count 
| eventstats sum(count) as day_total by day 
| eval perc = round(100* (count/day_total),2) 
| fields - count day day_total

View solution in original post

0 Karma

Path Finder

Thank you so much for your reply. I'm sorry my example search was wrong.

My original search is - sourcetype=iis | eval users=cs_username | timechart span=1d dc(users)

Would this change the search string much? I have replaced count with dc(users) in the hope that it would work

0 Karma

Champion

I updated my original answer to reflect your search. Please respond to my answer using the "Add Comment" link below it if you have more questions or issues. Otherwise, please accept the answer if it works for you.

0 Karma

Champion

Try this. You can change the span component to get higher or lower resolution.

sourcetype=iis
| timechart span=15m dc(cs_username) as count
| eval day = tonumber(strftime(_time,"%j")) 
| fillnull value=0 count 
| eventstats sum(count) as day_total by day 
| eval perc = round(100* (count/day_total),2) 
| fields - count day day_total

View solution in original post

0 Karma

Path Finder

That is exactly what I needed. Thank you so much!!

0 Karma