Thanks so much.
However, I would like to return the top 3 x 3 hour time slots with the least amount of events not specific to line 5 in your suggestion.
Something like this instead:
your base search
| eval day_of_week = strftime(_time,"%A")
| eval time= strftime(_time,"%m/%a")." ".strftime(_time,"%H %p")." - ".strftime(Max,"%H %p")
| fieldformat Max=strftime(Max,"%m/%a %H:%M")
| tstats count latest(_time) as Max WHERE index=_internal BY _time span=3h
| where NOT (day_of_week="Saturday" OR day_of_week="Sunday") AND (hour>=9 AND hour<17)
| stats count dc(_time) as days by day_of_week period
| eval average_count = count/days
| sort 3 average_count
| fields day_of_week, period, count
However, the above does not seem to work, can you help me out? Cheers
... View more