index=sample_index path=*/sample_path* responseCode=200 OR responseCode=403 | timechart span=1m count by responseCode | where '403' > 0 ... View more

Exactly what I wanted. Thanks bunch Daniel. ... View more

I adjusted your search to use the _internal index, you should be able to adjust the SPL to suit your use case. This is where I would use eventstats to create a new field on each even that had the max value, and then filter to just those. And if you have two time buckets that have the same, grab just the latest.   index=_internal | bucket _time span=1m | stats count by sourcetype _time | eventstats max(count) as maxcount by sourcetype ```Get the max count for all buckets by sourcetype``` | where maxcount=count ```Filter down to where the maxcount is the count``` | stats latest(_time) AS _time, latest(count) by sourcetype ```Get just the latest time for that sourcetype, and the count``` ... View more

My use case is to find the highest traffic per minute. Is this possible to find the time as well to identify when the spike in traffic happened ? ... View more

This was helpful but didn't exactly serve my requirement. Has to change a little bit for the final working query | rex max_match=0 "(?<isOutstanding>isOutstanding\\\\\":true)" | stats count(isOutstanding) as total   ... View more