topic Re: Query to calculate max TPS over period of time (3 months) everyday in Monitoring Splunk

Query to calculate max TPS over period of time (3 months) everyday

Sishad — Sun, 13 Oct 2024 15:57:54 GMT

Hi Splunk Experts,

Can you please let me know how we can calculate the max and avg TPS for a time period of last 3 months along with the exact time of occurrence.

I came up with below query, but it is showing me error as the count of event is greater than 50000.
Can anyone please help or guide me on how to overcome this issue.

index=XXX "attrs"=traffic NOT metas | timechart span=1s count AS TPS | eventstats max(TPS) as MAX_TPS | eval Peak_Time=if(MAX_TPS==TPS,_time,null()) | stats avg(TPS) as AVG_TPS first(MAX_TPS) as MAX_TPS first(Peak_Time) as Peak_Time | fieldformat Peak_Time=strftime(Peak_Time,"%x %X")

Re: Query to calculate max TPS over period of time (3 months) everyday

PickleRick — Sun, 13 Oct 2024 16:43:19 GMT

Well, 1s span for three days is indeed quite a lot of results but I don't see a problem with that.

A run-anywhere example

| makeresults count=3000000
| streamstats count 
| eval _time=_time-count/10
| eval _time=_time+((random()%10-5))
| timechart span=1s count

What version are you using?

EDIT: OK, I read days where you wanted months. Still it's less than 8 million rows. It might be a bit performance-intensive but Splunk should manage provided you have enough memory.

And to limit memory usage, remove the raw event value as early as possible. So

<your initial search> | fields - _raw | timechart ...

Re: Query to calculate max TPS over period of time (3 months) everyday

Sishad — Sun, 13 Oct 2024 17:07:16 GMT

Version is Splunk Cloud 9.1.2312

I am looking for only these values day wise may be in last 7 days.

Re: Query to calculate max TPS over period of time (3 months) everyday

PickleRick — Sun, 13 Oct 2024 18:16:14 GMT

It looks strange but I'm no expert on Cloud. Are you sure it isn't about visualization only?

Anyway, you can probably emulate your relatively simple timechart with either simple

bin | stats by _time

or several passes with streamstats