This is what I was looking for. Thank you Vijeta. ... View more

I am looking for something similar. Buy my search is not giving proper c value. If I select seven days, then c value will be 1 (i.e. one week cannot have more than 1 Monday, 1 Tuesday....) If my duration is 2 weeks then C value should be 2. How to get proper c value. I am getting proper D value. PFB my search. index="apigee" sourcetype="apigee:hec" | search DeveloperAppName="someappname" | convert timeformat="%A" ctime(_time) AS date | eventstats count(date) as C | eventstats count as D by date| stats values(C) as C, values(D) as D by date| eval AVG= D/C * 100 Your help is appreciated. ... View more

@bcherdak : What is the best way to exclude event that start with foo*? your search | where NOT like(host,"foo%") This should do the magic. ... View more

I owe you a beer. It worked flawlessly. Thank you very much for helping me on a weekend. ... View more

You rock man. It worked flawlessly. But in results in time column I am getting 8/21/14 12:00:00.000 AM. I need the exact hour when the sales was high. Can we have two different names for the bucket. I replaced the second _time with some different name but it didn't work. Can you help me in getting the exact time as well in the result. Your help will be highly appreciated. ... View more

Exactly. Could you please respond to my comment for your updated answer? ... View more

Thank you very much Strive. Hourly Peak Volume worked flawlessly but when I removed “eventstats max(Total_Sales) as Max by _time, Make” I was not able to see any difference. My main requirement was Max of peak hour volume. i.e. Max of 24 hrs. data. But it didn’t work as I expected. To make it clear. Based on the above table I was able to sell only 1 Accord from 5:00 – 6:00 but I was able to sell 2 Accords from 6:00 – 7:00. Then my result should be 6:00 – 7:00 Honda Accord 2 Assume if I sell 15 Accords from 7:00 to 8:00 and 12 Accords from 8:00 to 9:00 Then the result at 9:00 ‘o’ clock should be 7:00 – 8:00 Honda Accord 15 Per day: Some search terms... | bucket _time span=1d | stats count(Model Sold) as Total_Sales by _time, Make, "Model Sold" | eventstats max(Total_Sales) as Max by _time, Make | where Total_Sales = Max | rename Total_Sales as "No of Models Sold" | fields – Max If I use the above search I am getting sum of every one hour i.e. This is what I am getting Time Make Model Sold No of items Sold 8/21/14 12:00:00.000 AM Honda Accord 3 8/21/14 12:00:00.000 AM Honda Civic 3 8/21/14 12:00:00.000 AM Toyota Corolla 4 8/21/14 12:00:00.000 AM Toyota Camry 3 But I need max of every one hour(Check the expected result above). It needs a slight fine tuning. I was able to get the expected result using the below search Some search terms... | bucket _time span=1h | stats count(Model Sold) as Total_Sales by _time, Make, "Model Sold" | bucket _time span=1d | eventstats max(Total_Sales) as Max by _time, Make | where Total_Sales = Max | rename Total_Sales as "No of Models Sold" | fields – Max I introduced one more bucket. But in results in time column I am getting 8/21/14 12:00:00.000 AM. I need the exact hour when the sales was high. Can we have two different names for the bucket. I replaced the second _time with some different name but it didn't work. Can you help me in getting the exact time as well in the result. Your help will be highly appreciated ... View more

Actually there won't be any time in logs. It is just the indexed time. If i choose last 4 days then i should get only one result for each day for each model sold.i.e Peak hour sale of a day(24 hrs). Normally it happens during happy hours. ... View more

This is exactly i was looking for. Thank you very much HiroshiSatoh. ... View more

I don't want to calculate average. i need all points to be plotted in chart(line chart). In Below search if the search results is < 10 I'm able to see the labels. But if the result is > 10 the label stars disappearing. I don't want to show all the time in x-axis. Just 12 points. i.e 00:00, 2:00, 4:00 .. index=main sourcetype=myTest host="hello1234" getUserDetail | rex "(?im)^(?:[^:]:){4}\s(?P (?P [^T] )T(?P [^-]))-(?:[^,],){6}(?P [^,]+),(?P [^,]*),(?P [^(ms)]+)ms" | where DURATION >= 10000 | sort -DURATION | chart list(DURATION) by _time ... View more