I want to find out which day of the week and time range has the least amount of traffic during the past 30 days during working hours in 3 hour groups.
The search results should return the day and time range.
Example: Monday 9am - 12pm.
Bonus points if you can help me return the top 3 results. Example: Monday 9am - 12pm, Monday 3pm - 6pm and Friday 3pm - 6pm.
@bamalone, try the following search for Last 30 days
| tstats count latest(_time) as Max WHERE index=_internal BY _time span=3h
| fieldformat Max=strftime(Max,"%m/%a %H:%M")
| eval Time= strftime(_time,"%m/%a")." ".strftime(_time,"%H %p")." - ".strftime(Max,"%H %p")
| table Time count
| sort count
| head 3
PS: Replace with your index as above one is run anywhere search example with Splunk's _internal index.