The following Splunk query will return the most active and the least active days for web traffic in an IIS environment:

sourcetype="iis" | bucket span=1d _time | top limit=1 _time | eval Date=strftime(_time, "%m/%d/%Y") | eval Metric="Most Active Date" | append [ search sourcetype="iis" | bucket span=1d _time | rare limit=1 _time | eval Date=strftime(_time, "%m/%d/%Y") | eval Metric="Least Active Date"] | fields - _time, count, percent | fields Metric, Date