How-to
Interpreting the Timeseries Chart
How to read the requests-over-time chart and spot anomalies.
1 min readLast updated 26 April 2026
Jump to section
What the chart shows
The timeseries chart on the Overview page shows total requests per time bucket, broken down by status class (2xx, 499, 3xx, 4xx, 5xx). The bucket size adapts to the selected range:
| Range | Bucket |
|---|---|
| 1 hour | 1 minute |
| 6 hours | 5 minutes |
| 24 hours | 15 minutes |
| 7 days | 1 hour |
| 30 days | 6 hours |
What to look for
- Flat top with sudden spike: a burst of traffic from a single source. Check the Offenders page to identify the ASN.
- 499 line climbing: scrapers ramping up. Even if the total volume looks normal, the 499 proportion growing is a signal.
- Missing gaps: periods with no data points indicate Logpush wasn't delivering (check the source's last_seen_at).
- Shift in time-of-day pattern: if traffic that was previously concentrated in business hours suddenly runs 24/7, it's likely automated.
Resolution note
The chart's time resolution depends on how frequently Cloudflare Logpush ships batches. With the recommended frequency = high setting, you get minute-level resolution. With the default frequency = low, resolution is ~5 minutes.