The fast and easy way is to use timechart, assuming that your base search selects the interesting events, and you only need the hour with the highest count , i.e. <your search> | timechart span=1h count The harder way is to find the 60 (or 120) minute period with the highest count (still assuming that your base search will select the interesting events). This search will result in a single line with start and stop times, and of course the max count. Replace the window=60 to any number of your choice. <your search>| timechart span=1m count AS cc | streamstats sum(cc) AS acc_roll_max window=60 | eval start = strftime (_time - 3600, "%Y-%m-%d %H:%M:%S") | eval stop = strftime(_time, "%Y-%m-%d %H:%M:%S") | sort - acc_roll_max | head 1 | fields - cc, _time Hope this helps, Kristian ... View more