finding peak times from timechart (Part 2)

[Software-Simian]

Hello,

i am aware that there already is a Question from way back called:

"finding peak and low times from timechart"

However in that solution i only can get max and min values overall.

i tried to adapt the solution for my issue. Here it goes...

I have multiple customers and want to find peaks for everyone of them. Whilst the solution:

index=web GET OR POST | timechart span=1h count 
| eventstats max(count) as high, min(count) as low
| where (count=low OR count=high)
| fields _time, count

works perfectly for overall peaks i struggle to get it flying with an "by" command for customers...so something like:

| timechart span=1hour count  by customer
| eventstats max(count) as high, min(count) as low by customer

at this point there however is no field "count" anymore

Kind regards,

Mike

[PickleRick]

index=web GET OR POST
| bin _time span=1h
| stats count by _time customer 
| sort customer - count
| sort first(_time) first(count) last(_time) last(count) by customer

Something  like that?

[johnhuang · Accepted solution]

A. Either use eventstats to calculate max and filter (which was the approach you were trying).

index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer

| eventstats max(event_count) AS peak_count BY customer
| where event_count=peak_count

B. Or just sort and dedup:

index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer

| sort 0 - event_count
| dedup customer