How-to
Interpreting the Timeseries Chart
How to read the requests-over-time chart and spot anomalies.
What the chart shows
The timeseries chart on the Overview page shows total requests per time bucket, broken down by status class (2xx, 499, 3xx, 4xx, 5xx). The bucket size adapts to the selected range:
| Range | Bucket |
|---|---|
| 1 hour | 1 minute |
| 6 hours | 5 minutes |
| 24 hours | 15 minutes |
| 7 days | 1 hour |
| 30 days | 6 hours |
What to look for
- Flat top with sudden spike: a burst of traffic from a single source. Check the Offenders page to identify the ASN.
- 499 line climbing: scrapers ramping up. Even if the total volume looks normal, the 499 proportion growing is a signal.
- Missing gaps: periods with no data points indicate Logpush wasn't delivering (check the source's last_seen_at).
- Shift in time-of-day pattern: if traffic that was previously concentrated in business hours suddenly runs 24/7, it's likely automated.
Alert and incident markers
Above the chart, the Markers control can overlay your open alerts and open incidents onto the timeline, each pinned to the moment it opened. Two toggles, Open alerts and Incidents, turn each layer on or off, and your choice is remembered on this browser. A marker sits where its alert or incident was raised, so a spike in the chart and the detector that fired against it line up in one view.
Resolution note
The chart's time resolution depends on how frequently Cloudflare Logpush ships batches. With the recommended frequency = high setting, you get minute-level resolution. With the default frequency = low, resolution is ~5 minutes.