https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-cumulative-total-into-a-rate/m-p/120891#M184062 <P>I have this field which display the total number of transactions since the server has been started. I need to find out our transaction rate and I can't seem to do this in Splunk.<BR /> Our stats gets collected every 5 minutes and look something like this:</P> <P>01:10am Messages=1000<BR /> 01:15am Messages=1500<BR /> 01:20am Messages=2000<BR /> etc..<BR /> That means that between 1:10 and 1:15 the server processed 500 transactions and that's the result I need to get from Splunk so that I can calculate our transactions per second rate.</P> <P>As far as I can tell Splunk would need to know the previous 5 minute value and compare to the current value of the field.</P> <P>I tried this but it doesn't work as I get the accumulated total:<BR /> | stats sum(eval(Msgs/300)) as Trans by host</P> <P>Thanks for any help.</P> Tue, 29 Oct 2013 19:59:50 GMT adriangrassi 2013-10-29T19:59:50Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-cumulative-total-into-a-rate/m-p/120891#M184062 <P>I have this field which display the total number of transactions since the server has been started. I need to find out our transaction rate and I can't seem to do this in Splunk.<BR /> Our stats gets collected every 5 minutes and look something like this:</P> <P>01:10am Messages=1000<BR /> 01:15am Messages=1500<BR /> 01:20am Messages=2000<BR /> etc..<BR /> That means that between 1:10 and 1:15 the server processed 500 transactions and that's the result I need to get from Splunk so that I can calculate our transactions per second rate.</P> <P>As far as I can tell Splunk would need to know the previous 5 minute value and compare to the current value of the field.</P> <P>I tried this but it doesn't work as I get the accumulated total:<BR /> | stats sum(eval(Msgs/300)) as Trans by host</P> <P>Thanks for any help.</P> Tue, 29 Oct 2013 19:59:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-cumulative-total-into-a-rate/m-p/120891#M184062 adriangrassi 2013-10-29T19:59:50Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-cumulative-total-into-a-rate/m-p/120892#M184063 <P><CODE>...| table _time Messages | delta Messages as Current | eval TransRate = Curr / 300</CODE></P> <P>/k</P> Tue, 29 Oct 2013 21:26:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-cumulative-total-into-a-rate/m-p/120892#M184063 kristian_kolb 2013-10-29T21:26:35Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-cumulative-total-into-a-rate/m-p/120893#M184064 <P>I was able to finally get this working using the following query:</P> <P>search | bucket _time span=5m | stats sum(eval(Msgs)) as 5MinCount by host _time | delta 5MinCount | sort _time | stats latest by host | rename latest(delta(5MinCount)) as delta | stats sum(eval(delta/300)) as Transactions_per_sec by host</P> <P>This query above takes 2 samples of a cumulative total and finds the difference between them and then calculates the rate while ignoring the 1st set of delta data which is invalid since it has nothing to compare against.</P> <P>Hopefully this helps someone else in the same situation.<BR /> For the record I still think that converting a cumulative total into a transaction rate should have been its own function in Splunk.</P> <P>Thanks, <BR /> -Adrian</P> Mon, 28 Sep 2020 15:11:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-a-cumulative-total-into-a-rate/m-p/120893#M184064 adriangrassi 2020-09-28T15:11:03Z