topic Re: Calculating throughput in Splunk Search

Calculating throughput

ghildiya — Mon, 27 Jul 2020 14:17:49 GMT

In splunk logs, I have to monitor some specific events. The identifier I use to target for those events is a text 'EVENT_PROCESSED'. So my search query is:

index=testIndex namespace=testNameSpace host=\*testHost* log=\*EVENT_PROCESSED*

It fetches me ll of my target events. Please note that EVENT_PROCESSED is not an extracted field and is just a text in the event logs.

Now my aim is to find throughput for these events. So I do this:

index=testIndex namespace=testNameSpace host=\*testHost* log=\*EVENT_PROCESSED* | timechart span=1s count as throughtput

Is this correct way of determining throughput rate? If I change span to some other value, say 1h, then I change to:

index=testIndex namespace=testNameSpace host=\*testHost* log=\*EVENT_PROCESSED* | timechart span=1h count/3600 as throughtput

Is this correct way?

Re: Calculating throughput

spitchika — Mon, 27 Jul 2020 14:59:39 GMT

When you use your first query, you need to say throughput in "per sec" unit. With span=1h, you can still use "count" only say throughput in "Per hour" unit. If you still want to calculation then store count into another variable like | eventstats count as "Totalcount" then do calculation using eval

Re: Calculating throughput

spitchika — Mon, 27 Jul 2020 15:04:44 GMT

index=testIndex namespace=testNameSpace host=\*testHost* log=\*EVENT_PROCESSED* | eventstats count as "TotalCount" | eval throughput=TotalCount/3600 | timechart span=1h values(throughput)

Your query might look like this.

Re: Calculating throughput

ghildiya — Mon, 27 Jul 2020 16:26:08 GMT

This displays graphs with dots, even for line chart while Line chart is expected to show continuous curves.

Re: Calculating throughput

spitchika — Mon, 27 Jul 2020 16:55:53 GMT

Let me check

Re: Calculating throughput

spitchika — Mon, 27 Jul 2020 17:13:42 GMT

This works perfectly for your requirement.

index=abc host=* source=/var/opt/appworkr/logs/logname "item"
| timechart span=1h count
| eval Throughput=round(count/3600,0)
| timechart span=1h values(Throughput)