Most Active Day and Least Active Day for IIS Web Traffic

The following Splunk query will return the most active and the least active days for web traffic in an IIS environment:

sourcetype="iis" | bucket span=1d _time |top limit=1 _time | eval Date=strftime(_time, "%m/%d/%Y") | eval Metric="Most Active Date" | append  | fields - _time, count, percent | fields Metric, Date
Share This:

Leave A Comment?