<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to calculate total_OPS? in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-total-OPS/m-p/585452#M103000</link>
    <description>&lt;P&gt;Query:&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;index=xxx source=Perfmon:LogicalDisk host=$h$ ( counter="Disk Reads/sec" OR counter="Disk Writes/sec" )
| eval read_ops=IF(counter="Disk Reads/sec",Value,0)
| eval write_ops=IF(counter="Disk Writes/sec",Value,0)
| eval tot_ops=write_ops+read_ops
| fields read_ops write_ops tot_ops 
| timechart max(read_ops) max(write_ops) max(tot_ops)
&lt;/LI-CODE&gt;
&lt;P&gt;&lt;BR /&gt;Need to sum the read_ops and write_ops into field total ops for each time interval (1 min) for a timechart.&lt;/P&gt;
&lt;P&gt;Because the writes ops and read ops values are in separate rows per time interval. example below:&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;
&lt;TABLE width="773px"&gt;
&lt;TBODY&gt;
&lt;TR&gt;
&lt;TD width="109px" height="113px"&gt;&lt;SPAN class=""&gt;&lt;SPAN&gt;2/16/22&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;5:29:59.000 PM&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/TD&gt;
&lt;TD width="624px" height="113px"&gt;
&lt;DIV class=""&gt;
&lt;DIV class=""&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;DIV class=""&gt;&lt;SPAN class=""&gt;02/16/2022&lt;/SPAN&gt; &lt;SPAN class=""&gt;17:29:59.224&lt;/SPAN&gt; &lt;SPAN class=""&gt;-0500&lt;/SPAN&gt; &lt;SPAN class=""&gt;collection=LogicalDisk&lt;/SPAN&gt; &lt;SPAN class=""&gt;object=LogicalDisk&lt;/SPAN&gt; &lt;SPAN class=""&gt;counter=&lt;/SPAN&gt;"&lt;SPAN class=""&gt;Disk&lt;/SPAN&gt; &lt;SPAN class=""&gt;Writes/sec&lt;/SPAN&gt;" &lt;SPAN class=""&gt;instance=_Total&lt;/SPAN&gt; &lt;SPAN class=""&gt;Value=27.222955244825506&lt;/SPAN&gt;&lt;/DIV&gt;
&lt;A href="https://splunkretail.bankofamerica.com/en-US/app/search/search?s=%2FservicesNS%2Fnbdrmt1%2Fsearch%2Fsaved%2Fsearches%2FxIOPS%2520per%2520HOST&amp;amp;dispatch.sample_ratio=1&amp;amp;display.general.type=statistics&amp;amp;display.page.search.mode=verbose&amp;amp;display.page.search.tab=events&amp;amp;q=search%20(earliest%3D-2h)%20index%3Dcsw_os_win%20source%3DPerfmon%3ALogicalDisk%20host%3Dwpa10bwmeddm0av%20(%20counter%3D%22Disk%20Reads%2Fsec%22%20OR%20counter%3D%22Disk%20Writes%2Fsec%22%20)%0A%7C%20eval%20read_ops%3DIF(counter%3D%22Disk%20Reads%2Fsec%22%2CValue%2C0)%0A%7C%20eval%20write_ops%3DIF(counter%3D%22Disk%20Writes%2Fsec%22%2CValue%2C0)%0A%7C%20eval%20tot_ops%3DValue%0A%7C%20fields%20read_ops%20write_ops%20tot_ops%0A%7C%20timechart%20max(read_ops)%20max(write_ops)%20max(tot_ops)%0A%60%60%60%7C%20timechart%20max(read_ops)%20max(write_ops)%20max(tot_ops)%20%60%60%60&amp;amp;earliest=-1m%40m&amp;amp;latest=now&amp;amp;sid=1645050758.1264059_8A739B57-A102-4975-B0E6-7AFD9C399845#" target="_blank" rel="noopener"&gt;Collapse&lt;/A&gt;&lt;/DIV&gt;
&lt;DIV class=""&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;/TD&gt;
&lt;TD width="40px"&gt;&amp;nbsp;&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="109px"&gt;&lt;SPAN class=""&gt;&lt;SPAN&gt;2/16/22&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;5:29:59.000 PM&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/TD&gt;
&lt;TD width="624px"&gt;
&lt;DIV class=""&gt;
&lt;DIV class=""&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;DIV class=""&gt;&lt;SPAN class=""&gt;02/16/2022&lt;/SPAN&gt; &lt;SPAN class=""&gt;17:29:59.224&lt;/SPAN&gt; &lt;SPAN class=""&gt;-0500&lt;/SPAN&gt; &lt;SPAN class=""&gt;collection=LogicalDisk&lt;/SPAN&gt; &lt;SPAN class=""&gt;object=LogicalDisk&lt;/SPAN&gt; &lt;SPAN class=""&gt;counter=&lt;/SPAN&gt;"&lt;SPAN class=""&gt;Disk&lt;/SPAN&gt; &lt;SPAN class=""&gt;Reads/sec&lt;/SPAN&gt;" &lt;SPAN class=""&gt;instance=_Total&lt;/SPAN&gt; &lt;SPAN class=""&gt;Value=5.316598854323969&lt;/SPAN&gt;&lt;/DIV&gt;
&lt;A href="https://splunkretail.bankofamerica.com/en-US/app/search/search?s=%2FservicesNS%2Fnbdrmt1%2Fsearch%2Fsaved%2Fsearches%2FxIOPS%2520per%2520HOST&amp;amp;dispatch.sample_ratio=1&amp;amp;display.general.type=statistics&amp;amp;display.page.search.mode=verbose&amp;amp;display.page.search.tab=events&amp;amp;q=search%20(earliest%3D-2h)%20index%3Dcsw_os_win%20source%3DPerfmon%3ALogicalDisk%20host%3Dwpa10bwmeddm0av%20(%20counter%3D%22Disk%20Reads%2Fsec%22%20OR%20counter%3D%22Disk%20Writes%2Fsec%22%20)%0A%7C%20eval%20read_ops%3DIF(counter%3D%22Disk%20Reads%2Fsec%22%2CValue%2C0)%0A%7C%20eval%20write_ops%3DIF(counter%3D%22Disk%20Writes%2Fsec%22%2CValue%2C0)%0A%7C%20eval%20tot_ops%3DValue%0A%7C%20fields%20read_ops%20write_ops%20tot_ops%0A%7C%20timechart%20max(read_ops)%20max(write_ops)%20max(tot_ops)%0A%60%60%60%7C%20timechart%20max(read_ops)%20max(write_ops)%20max(tot_ops)%20%60%60%60&amp;amp;earliest=-1m%40m&amp;amp;latest=now&amp;amp;sid=1645050758.1264059_8A739B57-A102-4975-B0E6-7AFD9C399845#" target="_blank" rel="noopener"&gt;Collapse&lt;/A&gt;&lt;/DIV&gt;
&lt;/TD&gt;
&lt;TD width="40px" height="25px"&gt;&amp;nbsp;&lt;/TD&gt;
&lt;/TR&gt;
&lt;/TBODY&gt;
&lt;/TABLE&gt;</description>
    <pubDate>Thu, 17 Feb 2022 15:56:40 GMT</pubDate>
    <dc:creator>malo1230</dc:creator>
    <dc:date>2022-02-17T15:56:40Z</dc:date>
    <item>
      <title>How to calculate total_OPS?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-total-OPS/m-p/585452#M103000</link>
      <description>&lt;P&gt;Query:&lt;/P&gt;
&lt;LI-CODE lang="markup"&gt;index=xxx source=Perfmon:LogicalDisk host=$h$ ( counter="Disk Reads/sec" OR counter="Disk Writes/sec" )
| eval read_ops=IF(counter="Disk Reads/sec",Value,0)
| eval write_ops=IF(counter="Disk Writes/sec",Value,0)
| eval tot_ops=write_ops+read_ops
| fields read_ops write_ops tot_ops 
| timechart max(read_ops) max(write_ops) max(tot_ops)
&lt;/LI-CODE&gt;
&lt;P&gt;&lt;BR /&gt;Need to sum the read_ops and write_ops into field total ops for each time interval (1 min) for a timechart.&lt;/P&gt;
&lt;P&gt;Because the writes ops and read ops values are in separate rows per time interval. example below:&lt;BR /&gt;&lt;BR /&gt;&lt;/P&gt;
&lt;TABLE width="773px"&gt;
&lt;TBODY&gt;
&lt;TR&gt;
&lt;TD width="109px" height="113px"&gt;&lt;SPAN class=""&gt;&lt;SPAN&gt;2/16/22&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;5:29:59.000 PM&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/TD&gt;
&lt;TD width="624px" height="113px"&gt;
&lt;DIV class=""&gt;
&lt;DIV class=""&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;DIV class=""&gt;&lt;SPAN class=""&gt;02/16/2022&lt;/SPAN&gt; &lt;SPAN class=""&gt;17:29:59.224&lt;/SPAN&gt; &lt;SPAN class=""&gt;-0500&lt;/SPAN&gt; &lt;SPAN class=""&gt;collection=LogicalDisk&lt;/SPAN&gt; &lt;SPAN class=""&gt;object=LogicalDisk&lt;/SPAN&gt; &lt;SPAN class=""&gt;counter=&lt;/SPAN&gt;"&lt;SPAN class=""&gt;Disk&lt;/SPAN&gt; &lt;SPAN class=""&gt;Writes/sec&lt;/SPAN&gt;" &lt;SPAN class=""&gt;instance=_Total&lt;/SPAN&gt; &lt;SPAN class=""&gt;Value=27.222955244825506&lt;/SPAN&gt;&lt;/DIV&gt;
&lt;A href="https://splunkretail.bankofamerica.com/en-US/app/search/search?s=%2FservicesNS%2Fnbdrmt1%2Fsearch%2Fsaved%2Fsearches%2FxIOPS%2520per%2520HOST&amp;amp;dispatch.sample_ratio=1&amp;amp;display.general.type=statistics&amp;amp;display.page.search.mode=verbose&amp;amp;display.page.search.tab=events&amp;amp;q=search%20(earliest%3D-2h)%20index%3Dcsw_os_win%20source%3DPerfmon%3ALogicalDisk%20host%3Dwpa10bwmeddm0av%20(%20counter%3D%22Disk%20Reads%2Fsec%22%20OR%20counter%3D%22Disk%20Writes%2Fsec%22%20)%0A%7C%20eval%20read_ops%3DIF(counter%3D%22Disk%20Reads%2Fsec%22%2CValue%2C0)%0A%7C%20eval%20write_ops%3DIF(counter%3D%22Disk%20Writes%2Fsec%22%2CValue%2C0)%0A%7C%20eval%20tot_ops%3DValue%0A%7C%20fields%20read_ops%20write_ops%20tot_ops%0A%7C%20timechart%20max(read_ops)%20max(write_ops)%20max(tot_ops)%0A%60%60%60%7C%20timechart%20max(read_ops)%20max(write_ops)%20max(tot_ops)%20%60%60%60&amp;amp;earliest=-1m%40m&amp;amp;latest=now&amp;amp;sid=1645050758.1264059_8A739B57-A102-4975-B0E6-7AFD9C399845#" target="_blank" rel="noopener"&gt;Collapse&lt;/A&gt;&lt;/DIV&gt;
&lt;DIV class=""&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;/TD&gt;
&lt;TD width="40px"&gt;&amp;nbsp;&lt;/TD&gt;
&lt;/TR&gt;
&lt;TR&gt;
&lt;TD width="109px"&gt;&lt;SPAN class=""&gt;&lt;SPAN&gt;2/16/22&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;5:29:59.000 PM&lt;/SPAN&gt;&lt;/SPAN&gt;&lt;/TD&gt;
&lt;TD width="624px"&gt;
&lt;DIV class=""&gt;
&lt;DIV class=""&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;DIV class=""&gt;&lt;SPAN class=""&gt;02/16/2022&lt;/SPAN&gt; &lt;SPAN class=""&gt;17:29:59.224&lt;/SPAN&gt; &lt;SPAN class=""&gt;-0500&lt;/SPAN&gt; &lt;SPAN class=""&gt;collection=LogicalDisk&lt;/SPAN&gt; &lt;SPAN class=""&gt;object=LogicalDisk&lt;/SPAN&gt; &lt;SPAN class=""&gt;counter=&lt;/SPAN&gt;"&lt;SPAN class=""&gt;Disk&lt;/SPAN&gt; &lt;SPAN class=""&gt;Reads/sec&lt;/SPAN&gt;" &lt;SPAN class=""&gt;instance=_Total&lt;/SPAN&gt; &lt;SPAN class=""&gt;Value=5.316598854323969&lt;/SPAN&gt;&lt;/DIV&gt;
&lt;A href="https://splunkretail.bankofamerica.com/en-US/app/search/search?s=%2FservicesNS%2Fnbdrmt1%2Fsearch%2Fsaved%2Fsearches%2FxIOPS%2520per%2520HOST&amp;amp;dispatch.sample_ratio=1&amp;amp;display.general.type=statistics&amp;amp;display.page.search.mode=verbose&amp;amp;display.page.search.tab=events&amp;amp;q=search%20(earliest%3D-2h)%20index%3Dcsw_os_win%20source%3DPerfmon%3ALogicalDisk%20host%3Dwpa10bwmeddm0av%20(%20counter%3D%22Disk%20Reads%2Fsec%22%20OR%20counter%3D%22Disk%20Writes%2Fsec%22%20)%0A%7C%20eval%20read_ops%3DIF(counter%3D%22Disk%20Reads%2Fsec%22%2CValue%2C0)%0A%7C%20eval%20write_ops%3DIF(counter%3D%22Disk%20Writes%2Fsec%22%2CValue%2C0)%0A%7C%20eval%20tot_ops%3DValue%0A%7C%20fields%20read_ops%20write_ops%20tot_ops%0A%7C%20timechart%20max(read_ops)%20max(write_ops)%20max(tot_ops)%0A%60%60%60%7C%20timechart%20max(read_ops)%20max(write_ops)%20max(tot_ops)%20%60%60%60&amp;amp;earliest=-1m%40m&amp;amp;latest=now&amp;amp;sid=1645050758.1264059_8A739B57-A102-4975-B0E6-7AFD9C399845#" target="_blank" rel="noopener"&gt;Collapse&lt;/A&gt;&lt;/DIV&gt;
&lt;/TD&gt;
&lt;TD width="40px" height="25px"&gt;&amp;nbsp;&lt;/TD&gt;
&lt;/TR&gt;
&lt;/TBODY&gt;
&lt;/TABLE&gt;</description>
      <pubDate>Thu, 17 Feb 2022 15:56:40 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-total-OPS/m-p/585452#M103000</guid>
      <dc:creator>malo1230</dc:creator>
      <dc:date>2022-02-17T15:56:40Z</dc:date>
    </item>
    <item>
      <title>Re: How to calculate total_OPS?</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-total-OPS/m-p/585471#M103001</link>
      <description>&lt;P&gt;&lt;a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/237813"&gt;@malo1230&lt;/a&gt;&amp;nbsp;&lt;BR /&gt;can you use span=1m&lt;BR /&gt;&lt;BR /&gt;in timechart command&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;&lt;SPAN&gt;| timechart span=1m&amp;nbsp;read_ops write_ops tot_ops&amp;nbsp;&amp;nbsp;&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 17 Feb 2022 05:52:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/How-to-calculate-total-OPS/m-p/585471#M103001</guid>
      <dc:creator>SanjayReddy</dc:creator>
      <dc:date>2022-02-17T05:52:15Z</dc:date>
    </item>
  </channel>
</rss>

