https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274963#M190265 <P>If you are using <CODE>All-time</CODE> the other answer won't work so try this one:</P> <PRE><CODE>index=cams component=uas sourcetype="forgerock:auth" o=sco message_desc = "Authentication Failed" | chart count min(_time) AS info_min_time max(_time) AS info_max_time BY Instance | eval TransactionsPerSecond = count/(info_max_time - info_min_time) | rename count AS "Number of transactions" | fields - info_* </CODE></PRE> Mon, 30 May 2016 16:34:29 GMT woodcock 2016-05-30T16:34:29Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274956#M190258 <P>How to get Transactions per second from the following table(table 1). I also have a table which gets me the per second transactions and avg. How can I use the table with average values (table 2)<BR /> The following search gives me the Table 1<BR /> <STRONG>index=cams component=uas sourcetype="forgerock:auth" o=sco | where message_desc = "Authentication Failed"| chart count over instance by message_desc | rename "Authentication Failed" as "Number of transactions"</STRONG></P> <P>Table 1:<BR /> <IMG src="https://community.splunk.com/storage/temp/134206-1.png" alt="alt text" /></P> <P>Following is the table 2 which I have which has the average of field values for each transaction type(Authentication failed) by instance viz., 11,12,21,22<BR /> <IMG src="https://community.splunk.com/storage/temp/134207-2.png" alt="alt text" /></P> Tue, 29 Sep 2020 09:49:31 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274956#M190258 jkalra 2020-09-29T09:49:31Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274957#M190259 <P>Your requirement is unclear. What exactly you're trying to do? Could you share your expect result/format?</P> Fri, 27 May 2016 19:08:31 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274957#M190259 somesoni2 2016-05-27T19:08:31Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274958#M190260 <P>Like this:</P> <PRE><CODE>index=cams component=uas sourcetype="forgerock:auth" o=sco | where message_desc = "Authentication Failed"| chart count over instance by message_desc | rename "Authentication Failed" as "Number of transactions" | addinfo | eval TransactionsPerSecond = $Number of transactions$/(info_max_time - info_min_time) | fields - info_* </CODE></PRE> Fri, 27 May 2016 20:10:33 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274958#M190260 woodcock 2016-05-27T20:10:33Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274959#M190261 <P>Thanks Gregg...<BR /> not sure what I should be using duration for.? it gives me an error at "duration"</P> Mon, 30 May 2016 14:50:38 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274959#M190261 jkalra 2016-05-30T14:50:38Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274960#M190262 <P>All I am trying to do is get a TPS(transactions per second) for the following table ( link below). I already have the "NUmber of transactions per instance namely 11, 12, 21, 21 and I am looking to get the TPS for 11,12,21,22 over any time range.</P> <P>I managed to get a table ( second table) which averages the Transactions by instance, but how do i get the TPS out of this. I would prefer to use the first table and get the TPS or the second table can also be used to derive TPS out of the average for each instance</P> <P><A href="https://answers.splunk.com/storage/temp/134206-1.png">https://answers.splunk.com/storage/temp/134206-1.png</A></P> Mon, 30 May 2016 14:56:44 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274960#M190262 jkalra 2016-05-30T14:56:44Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274961#M190263 <P>Sorry, that was a typo. I have fixed it in the original answer; try it again.</P> Mon, 30 May 2016 15:45:54 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274961#M190263 woodcock 2016-05-30T15:45:54Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274962#M190264 <P>Ok...thanks ...but I get info- max time as Infinity and info min time -0.00</P> Mon, 30 May 2016 16:29:30 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274962#M190264 jkalra 2016-05-30T16:29:30Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274963#M190265 <P>If you are using <CODE>All-time</CODE> the other answer won't work so try this one:</P> <PRE><CODE>index=cams component=uas sourcetype="forgerock:auth" o=sco message_desc = "Authentication Failed" | chart count min(_time) AS info_min_time max(_time) AS info_max_time BY Instance | eval TransactionsPerSecond = count/(info_max_time - info_min_time) | rename count AS "Number of transactions" | fields - info_* </CODE></PRE> Mon, 30 May 2016 16:34:29 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274963#M190265 woodcock 2016-05-30T16:34:29Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274964#M190266 <P>Gregg....I see no difference in the output...I still get just the Instance and Number of Transactions. no luck with the TPS.<BR /> Also, I was able to get the Avg number of transactions per second/instance. How do I get the TPS over any time range?</P> Tue, 31 May 2016 13:38:43 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274964#M190266 jkalra 2016-05-31T13:38:43Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274965#M190267 <P>The eventstats was in the wrong place. I edited my answer (and made your stuff more efficient). Try it again.</P> Tue, 31 May 2016 14:22:11 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274965#M190267 woodcock 2016-05-31T14:22:11Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274966#M190268 <P>Thanks Gregg...Unfortunately I get "No results" for any time range I select</P> Tue, 31 May 2016 17:41:25 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274966#M190268 jkalra 2016-05-31T17:41:25Z https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274967#M190269 <P>Gregg...sorry ..my bad..... i guess the "BY" command had to be a lower case...I changed that and it worked.</P> Tue, 31 May 2016 18:25:29 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-Transactions-per-second-based-on-average-values-for/m-p/274967#M190269 jkalra 2016-05-31T18:25:29Z