topic How to fetch relative fields out of timechart result based on Max(column) ? in Splunk Search

How to fetch relative fields out of timechart result based on Max(column) ?

sangs8788 — Tue, 12 Jun 2018 08:40:47 GMT

I have requirement where in i have to display in a timerange, what is the peak number of request per min and corresponding max response time during that min

Below is the query which gives me the for a span 1 min what was the count of thread and max response time for the selected timerange

host=test, index=prod | timechart  count(R) as ThreadCount, max(response_time) as ResponseTime by host_type

In above result i would like to get what was the peak numbr of request the host_type was able to handle and what was the maximum response time when it was handling the peak request. something similar to below,

host=test, index=prod | timechart  count(R) as ThreadCount, max(response_time) as ResponseTime by host_type|streamstats max(ThreadCount) as MaxThreadCount by host_type|sort +ThreadCount |stats first(ResponseTime) as CorrespondingResponseTime |where ThreadCount=MaxThreadCount|table MaxThreadCount, CorrespondingResponseTime

I am pretty sure something wrong in my query. Could you please help me in getting the peak number of request the host_type was able to handle and what was the maximum response time when it was handling the peak request.

Re: How to fetch relative fields out of timechart result based on Max(column) ?

logloganathan — Tue, 29 Sep 2020 19:58:17 GMT

Could you please provide the log and output sample you need for our better understanding

Also please try this query. i dont know whether its your requirement
host=test, index=prod | timechart count(R) as ThreadCount, max(response_time) as ResponseTime by host_type
| appendcols [ search host=test, index=prod | timechart count(R) as ThreadCount,max(ThreadCount) as MaxThreadCount by host_type ] | table ThreadCount ResponseTime MaxThreadCount

Re: How to fetch relative fields out of timechart result based on Max(column) ?

DalJeanis — Tue, 12 Jun 2018 23:07:33 GMT

This is what you asked for

 host=test, index=prod 
| bin _time span=1m
| stats count(R) as ThreadCount, max(response_time) as ResponseTime by host_type _time
| eventstats max(ThreadCount) as MaxThreadCount by host_type
| where ThreadCount = MaxThreadCount

However, I'd probably do something more like this...

 host=test, index=prod 
| bin _time span=1m
| stats count(R) as ThreadCount, max(response_time) as ResponseMax avg(response_time) as ResponseAvg by host_type _time
| eventstats perc90(ThreadCount) as p90Count by host_type
| where ThreadCount>=p90Count

Then, you can chew that up in various ways based upon what the shape of the results are.