Splunk Search

the max time of day

baoamin
New Member

hello guys

I have a problem at work

index=mailog relay=10.204.0.0 I timechart span=1h count I timechart span=1d max(count)as count1 I appendcols 「search index=mailog relay=10.203.0.0 I timechart span=1h count I timechart span=1d max(count)as count2」

I get the max value of everyday but I donot get the information what time is most

like 3/16 12:00 is most how to display the information of time

plz help me

Tags (1)
0 Karma

TISKAR
Builder

@baoamin, you can try this, you can paste all this request in your sarch bare,

index=_internal
| timechart span=1h count 
| eval day=strftime(_time,"%Y-%m-%d")
| eventstats max(count) as max by day
| where count=max
| fields _time, count

Try by this to test your request:

index=mailog relay=10.204.0.0 
|  timechart span=1h count 
| eval day=strftime(_time,"%Y-%m-%d")
| eventstats max(count) as max by day |  appendcols 
    [search index=mailog relay=10.203.0.0 | timechart span=1h count | eval day=strftime(_time,"%Y-%m-%d") | eventstats max(count) as max by day]
0 Karma

woodcock
Esteemed Legend

Like this:

index=mailog
| bucket _time span=1h
| stats count AS hourly_count BY host _time
| sort 0 - count
| dedup host
0 Karma

ssadanala1
Contributor

Hi,

In the search you are grouping the events by span=1h so it show the _time in this format 3/16 12 00:00
If you want the what hour time frame it occured most then your search should be like this

index=your time | timechart span=1h count as count |sort 1 count desc

I used sort command to sort the results in descending order and takes only the first value which is max of count .

0 Karma

fzfengzhuang
New Member

thank you for helping me

but but I need the max value of everyday per mouth

the table I want like this

time 2018-4-15 8:00 max_count 588
time 2018-4-16 10:00
max_count 600
……

can you help me

sorry for troubling you thanks

0 Karma

Sukisen1981
Champion

Hi,

Your requirement is not very clear to me. Here is what I understand, you want the max count based on hour and your output should be something like day, the hour the count was max max count
try |timechart span=1h count as count |timechart span=1h max(count) as count1| eventstats max(count1) as max | where count1=max|eval day=strftime(_time, "%Y-%m-%d") |eval hour=strftime(_time, "%Y-%m-%d %H:%M:%S")| fields day,hour,count1 | fields - _time

0 Karma

fzfengzhuang
New Member

thank you for helping me

but but I need the max value of everyday per mouth

the table I want like this

time 2018-4-15 8:00 max_count 588
time 2018-4-16 10:00
max_count 600
……

can you help me

sorry for troubling you thanks

0 Karma

Sukisen1981
Champion

Hi,
You say you need the max value per hour and then you also say you need max value every day. If you look at @p_gurav 's query and mine they are almost identical.

  1. We first get the counts per hour via timechart
  2. we then do an eventstats to figure
    out the max of the count per hour,
    for example at which hour was the
    count max

  3. we then simply put a where filter
    out the particular hour of the day
    where the count=max count in step
    2 above.

why is our query results different from what you want?

0 Karma

fzfeng
New Member

thank you sending me a message it was solved

thank you

0 Karma

fzfengzhuang
New Member

thank you every much

I just want the max value of mailog from hour 0 to 24 per day

and make the table like this

IP1_max_cou  IP2_max_count

2018-4-15 9:00 256 270
2018-4-16 11:00 328 255
2018-4-17 10:00 156 123

2018-4-17 15:00 8 9

sorry for troubling you

0 Karma

p_gurav
Champion

Can you try:

 | timechart  span=1h count as count  | timechart span=1d max(count) | eval _time=strftime(_time, "%Y-%m-%d %H:%M:%S")
0 Karma

baoamin
New Member

thank you I tried it but just display
2018-04-10 00:00:00
2018-04-11 00:00:00
.
.
.

why does it do not display the real time ?

thanks

0 Karma

p_gurav
Champion

Can you try something:

 |timechart span=1h count as count  | eval date=strftime(_time, "%x") | eventstats max(count) as count1 by date | where count=count1
0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...