https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607599#M211261 <P><SPAN>Thanks, is there a way to show the events through the data as when I do a search my results no where near match the number produced by using ev?</SPAN></P> Sat, 30 Jul 2022 07:43:53 GMT Rhidian 2022-07-30T07:43:53Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607547#M211235 <P>Hi,</P> <P>I'm trying to calculate the number of events per day so I can then divide by&nbsp;86400 to get the daily EPS. I know I can get the EPS "directly" using various queries like the below but I don't really understand the logic as what is the ev field and how is it calculated?</P> <LI-CODE lang="markup">index=_internal sourcetype=splunkd Metrics TERM(group=per_sourcetype_thruput) component=Metrics | fields ev series _time | rename ev as events, series as sourcetype | timechart limit=15 partial=f minspan=30s per_second(events) as EPS by sourcetype | append [ | tstats dc(source) as Sources, dc(sourcetype) as Sourcetypes, dc(host) as Hosts where index=* by _time | timechart partial=f sum(Sources) as Sources, sum(Sourcetypes) as Sourcetypes, sum(Hosts) as Hosts ] | timechart partial=f first(*) as * | addtotals | fields _time Total | appendpipe [| stats count | where count=0 | eval Total="0"]</LI-CODE> <P>&nbsp;</P> Fri, 29 Jul 2022 15:37:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607547#M211235 Rhidian 2022-07-29T15:37:46Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607553#M211236 <P>The <FONT face="courier new,courier">per_second</FONT> function sums the given field then divides the total by the number of seconds in the interval to get the per-second value.</P><P>The ev field in Metrics events is the number of events received in the current sampling interval.</P> Fri, 29 Jul 2022 15:36:32 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607553#M211236 richgalloway 2022-07-29T15:36:32Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607556#M211238 <P>So the sum of ev is the total number of events for the interval?&nbsp;</P> Fri, 29 Jul 2022 15:47:57 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607556#M211238 Rhidian 2022-07-29T15:47:57Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607569#M211246 <P>Yes, but it's not 100% accurate so the number calculated here may not match your license usage.&nbsp; See&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.0.0/Troubleshooting/Aboutmetricslog" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.0/Troubleshooting/Aboutmetricslog </A>and&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.0.0/Troubleshooting/Aboutmetricslog#Thruput_messages:~:text=The%20per_x_thruput%20categories%20are%20not%20complete" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.0/Troubleshooting/Aboutmetricslog#Thruput_messages:~:text=The%20per_x_thruput%20categories%20are%20not%20complete</A>.</P> Fri, 29 Jul 2022 16:44:44 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607569#M211246 richgalloway 2022-07-29T16:44:44Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607589#M211257 <P>Thanks, is there a way to show the events through the data as when I do a search my results no where near match the number produced by using ev?</P> Fri, 29 Jul 2022 21:31:44 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607589#M211257 Rhidian 2022-07-29T21:31:44Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607599#M211261 <P><SPAN>Thanks, is there a way to show the events through the data as when I do a search my results no where near match the number produced by using ev?</SPAN></P> Sat, 30 Jul 2022 07:43:53 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607599#M211261 Rhidian 2022-07-30T07:43:53Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607715#M211319 <P>Unfortunately summing ev&nbsp; suggests I had an EPS of&nbsp;<SPAN>18396 which is way off the mark. Any other ideas?</SPAN></P> Mon, 01 Aug 2022 08:17:59 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607715#M211319 Rhidian 2022-08-01T08:17:59Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607758#M211329 <P>Make sure the numbers being added are from the same interval.</P> Mon, 01 Aug 2022 13:13:42 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607758#M211329 richgalloway 2022-08-01T13:13:42Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607763#M211332 <P>Hi</P><P>from documentation which&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;pointed to you, you see this</P><LI-CODE lang="markup">By default, metrics.log reports the top 10 results for each type. You can change that number of series from the default by editing the value of maxseries in the [metrics] stanza in limits.conf.</LI-CODE><P>So it's not report all events which splunk ingesting/read/send etc. That's the reason why you cannot see/get correct values. All those values what you are getting from metrics.log are just estimates not exact values for all data.</P><P>If you need a real EPS you must count e.g. indexed events per time slot using _indextime not _time. Or another option is use some apps or another way to get exact numbers from needed place.</P><P>r. Ismo&nbsp;</P> Mon, 01 Aug 2022 13:26:29 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607763#M211332 isoutamo 2022-08-01T13:26:29Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607766#M211334 <P>To count events use the <FONT face="courier new,courier">tstats</FONT> command.</P><LI-CODE lang="markup">| tstats count where index=* _index_earliest=-1d@d _index_latest=@d by index</LI-CODE><P>&nbsp;</P> Mon, 01 Aug 2022 13:37:39 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/607766#M211334 richgalloway 2022-08-01T13:37:39Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/610325#M212240 <P>Thanks, could you please provide such a query?</P> Mon, 22 Aug 2022 11:52:08 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/610325#M212240 Rhidian 2022-08-22T11:52:08Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/671361#M230089 <P>Hello,</P> <P>is it possible to execute the following command to calculate Event per day in one week?</P> <LI-CODE lang="markup">index=* earliest=-7d | timechart span=1d count</LI-CODE> <P>&nbsp;</P> Sat, 09 Dec 2023 13:04:16 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/671361#M230089 maede_yavari 2023-12-09T13:04:16Z https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/671363#M230091 <P>Yes, it's possible, but don't do that.&nbsp; It tells Splunk to open every bucket with data from the last seven days and read all of the events from that time.&nbsp; It will be slow and wasteful of resources.&nbsp; Use <FONT face="courier new,courier">tstats</FONT>, instead.</P> Sat, 09 Dec 2023 13:25:07 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-calculate-the-number-of-Events-Per-Day-so-I-can-then/m-p/671363#M230091 richgalloway 2023-12-09T13:25:07Z