topic Re: VIEW n events pear second in Reporting

VIEW n events pear second

gbriones — Wed, 14 Apr 2021 15:51:12 GMT

I need to show first 40 events pear seconds in the range 15 minutes.

ITWhisperer — Wed, 14 Apr 2021 15:59:01 GMT

Assuming your search is over a 15 minute period, round time to seconds, and count events by second, then only keep the first 40 per second

... | eval seconds=round(_time,0) | streamstats count by seconds | where count <= 40

gbriones — Wed, 14 Apr 2021 16:11:06 GMT

Thanks for respond but I see to look more 40 events pear second:

gbriones_0-1618416601195.png

ITWhisperer — Wed, 14 Apr 2021 16:17:28 GMT

Does sorting by time first help?

... | sort _time | eval seconds=round(_time,0) | streamstats count by seconds | where count <= 40

gbriones — Wed, 14 Apr 2021 16:30:34 GMT

keeps showing results greater than 40 😞

gbriones — Wed, 14 Apr 2021 16:45:16 GMT

For example, if 100 events fell in one second, I need to only take the first 40 and continue with the next second

ITWhisperer — Wed, 14 Apr 2021 16:48:27 GMT

... | sort _time | eval seconds=floor(_time) | streamstats count by seconds | where count <= 40