Splunk Search

How to edit my search to find the time frame window with the least amount of events?

bamalone
New Member

Hi there,

I am trying to return the top 3 results of three hour windows where an event is least likely to happen based on the past 30 days during working hours (Monday - Friday 9am - 5pm).

So far I have

event name here
 | eval day_of_week = strftime(_time,"%A")
 | where NOT (day_of_week="Saturday" OR day_of_week="Sunday")
 | bin span=1d _time
 | stats count dc(_time) as days by day_of_week
 | eval average_count = count / days
 | eventstats avg(average_count)
 | sort Average_Count | head 3
 | fields day_of_week, count

I am looking to return something like:
Example: Monday 9am - 12pm, Monday 2pm - 5pm and Friday 2pm - 5pm.

An ideas how to improve my search and return what I am looking for? Cheers

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

your base search
| eval day_of_week = strftime(_time,"%A")
| eval hour=strftime(_time,"%H")
| where NOT (day_of_week="Saturday" OR day_of_week="Sunday") AND (hour>=9 AND hour<17)
| eval period=case(hour>=9 AND hour<12,"9 AM to 12 PM",hour>=12 AND hour<14,"12 PM to 2 PM",1=1,"2 PM to 5 PM")
| bin span=1d _time
| stats count dc(_time) as days by day_of_week period
| eval average_count = count/days
| sort 3 average_count
| eval day_of_week, period, count
0 Karma

bamalone
New Member

Thanks so much.

However, I would like to return the top 3 x 3 hour time slots with the least amount of events not specific to line 5 in your suggestion.

Something like this instead:

 your base search
 | eval day_of_week = strftime(_time,"%A")
 | eval time= strftime(_time,"%m/%a")." ".strftime(_time,"%H %p")." - ".strftime(Max,"%H %p") 
 | fieldformat Max=strftime(Max,"%m/%a %H:%M")
 | tstats count latest(_time) as Max WHERE index=_internal BY _time span=3h
 | where NOT (day_of_week="Saturday" OR day_of_week="Sunday") AND (hour>=9 AND hour<17)
 | stats count dc(_time) as days by day_of_week period
 | eval average_count = count/days
 | sort 3 average_count
 | fields day_of_week, period, count

However, the above does not seem to work, can you help me out? Cheers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...