Splunk Search

finding peak times from timechart (Part 2)

Software-Simian
Path Finder

Hello,

i am aware that there already is a Question from way back called:

"finding peak and low times from timechart"

However in that solution i only can get max and min values overall.

 

i tried to adapt the solution for my issue. Here it goes...

I have multiple customers and want to find peaks for everyone of them. Whilst the solution:

index=web GET OR POST | timechart span=1h count 
| eventstats max(count) as high, min(count) as low
| where (count=low OR count=high)
| fields _time, count

works perfectly for overall peaks i struggle to get it flying with an "by" command for customers...so something like:

| timechart span=1hour count  by customer
| eventstats max(count) as high, min(count) as low by customer

at this point there however is no field "count" anymore

Kind regards,

Mike

 

Labels (1)
Tags (1)
0 Karma
1 Solution

johnhuang
Motivator

A. Either use eventstats to calculate max and filter (which was the approach you were trying).

 

 

index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer

| eventstats max(event_count) AS peak_count BY customer
| where event_count=peak_count

 

 

B. Or just sort and dedup:

 

 

index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer

| sort 0 - event_count
| dedup customer

 

 

 

 

View solution in original post

PickleRick
SplunkTrust
SplunkTrust
index=web GET OR POST
| bin _time span=1h
| stats count by _time customer
| sort customer - count
| sort first(_time) first(count) last(_time) last(count) by customer

Something  like that?

johnhuang
Motivator

A. Either use eventstats to calculate max and filter (which was the approach you were trying).

 

 

index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer

| eventstats max(event_count) AS peak_count BY customer
| where event_count=peak_count

 

 

B. Or just sort and dedup:

 

 

index=web GET OR POST
| bucket _time span=1h
| stats count AS event_count by _time customer

| sort 0 - event_count
| dedup customer

 

 

 

 

Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...