Find peak 10-minute traffic window per day

Problem / use case

You want to track system reliability by identifying, for each day, the specific 10-minute time window that experienced the highest number of ERROR logs. This helps pinpoint the most critical time periods for troubleshooting.

Query

source logs
| filter $m.severity == ERROR
| groupby $m.timestamp / 10m as bucket.ts count() as bucket.count 
| groupby bucket.ts / 1d as day max_by(bucket.count, bucket) as bucket
| choose day.formatTimestamp('%d-%m-%Y') as day, bucket.count as count, bucket.ts.formatTimestamp('%d-%m-%Y %H:%M') as ts

Expected output

Variations

• Change the alert_severity to 'WARNING' or another level for different insights.
• Adjust 10m to another duration like 5m or 30m depending on your granularity needs.
• Include additional grouping fields like service_name to break down by component.

Previous Summarize container restarts

Next Parsing date strings

Theme

Light

light

dark