Using per_second with summary index not working

techols — Sat, 01 Apr 2017 18:08:11 GMT

I have a saved search:

source=/opt/app/workload/MCRRepo/*/*.csv
| rex "(?.*),(?.*),(?.*),(?.*),(?.*),(?.*)"
| search componentName=ServiceComponent* measurementName=transactionAttempts
| sitimechart span=5m per_second(counterValue)

When I run the normal version of this query over a 24 hour period:

source=/opt/app/workload/MCRRepo/*/*.csv
| rex "(?.*),(?.*),(?.*),(?.*),(?.*),(?.*)"
| search componentName=ServiceComponent* measurementName=transactionAttempts
| timechart span=5m per_second(counterValue)

I get per_second ranges of up to 7000 TPS which matches the expected range of my data. But when I run the query against the summary index using the query over a 7 day or longer period:

index=summary search_name="MCR_TPS" 
| timechart span=5min per_second(counterValue)

I get per_second ranges up to 200K. What am I missing? The TPS should still range up to 7000 TPS for each of the 7 days.

Re: Using per_second with summary index not working

DalJeanis — Mon, 03 Apr 2017 18:02:00 GMT

try this

index=summary search_name="MCR_TPS"

and this

index=summary search_name="MCR_TPS" | sitimechart span=5min per_second(counterValue)

Re: Using per_second with summary index not working

woodcock — Mon, 11 Sep 2017 01:50:31 GMT

What is the timepicker window for the populating search that is dropping events into your summary index?

topic Using per_second with summary index not working in Knowledge Management

Using per_second with summary index not working

Re: Using per_second with summary index not working

Re: Using per_second with summary index not working