Hello,
i am aware that there already is a Question from way back called:
"finding peak and low times from timechart"
However in that solution i only can get max and min values overall.
i tried to adapt the solution for my issue. Here it goes...
I have multiple customers and want to find peaks for everyone of them. Whilst the solution:
index=web GET OR POST | timechart span=1h count | eventstats max(count) as high, min(count) as low | where (count=low OR count=high) | fields _time, count
works perfectly for overall peaks i struggle to get it flying with an "by" command for customers...so something like:
| timechart span=1hour count by customer
| eventstats max(count) as high, min(count) as low by customer
at this point there however is no field "count" anymore
Kind regards,
Mike
A. Either use eventstats to calculate max and filter (which was the approach you were trying).
index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer
| eventstats max(event_count) AS peak_count BY customer
| where event_count=peak_count
B. Or just sort and dedup:
index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer
| sort 0 - event_count
| dedup customer
index=web GET OR POST
| bin _time span=1h
| stats count by _time customer
| sort customer - count
| sort first(_time) first(count) last(_time) last(count) by customer
Something like that?
A. Either use eventstats to calculate max and filter (which was the approach you were trying).
index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer
| eventstats max(event_count) AS peak_count BY customer
| where event_count=peak_count
B. Or just sort and dedup:
index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer
| sort 0 - event_count
| dedup customer