Splunk Search

finding peak times from timechart (Part 2)

Software-Simian
Path Finder

Hello,

i am aware that there already is a Question from way back called:

"finding peak and low times from timechart"

However in that solution i only can get max and min values overall.

 

i tried to adapt the solution for my issue. Here it goes...

I have multiple customers and want to find peaks for everyone of them. Whilst the solution:

index=web GET OR POST | timechart span=1h count 
| eventstats max(count) as high, min(count) as low
| where (count=low OR count=high)
| fields _time, count

works perfectly for overall peaks i struggle to get it flying with an "by" command for customers...so something like:

| timechart span=1hour count  by customer
| eventstats max(count) as high, min(count) as low by customer

at this point there however is no field "count" anymore

Kind regards,

Mike

 

Labels (1)
Tags (1)
0 Karma
1 Solution

johnhuang
Motivator

A. Either use eventstats to calculate max and filter (which was the approach you were trying).

 

 

index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer

| eventstats max(event_count) AS peak_count BY customer
| where event_count=peak_count

 

 

B. Or just sort and dedup:

 

 

index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer

| sort 0 - event_count
| dedup customer

 

 

 

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust
index=web GET OR POST
| bin _time span=1h
| stats count by _time customer
| sort customer - count
| sort first(_time) first(count) last(_time) last(count) by customer

Something  like that?

johnhuang
Motivator

A. Either use eventstats to calculate max and filter (which was the approach you were trying).

 

 

index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer

| eventstats max(event_count) AS peak_count BY customer
| where event_count=peak_count

 

 

B. Or just sort and dedup:

 

 

index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer

| sort 0 - event_count
| dedup customer

 

 

 

 

Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...