topic Re: graphing a logs per second value in Splunk Search

graphing a logs per second value

acidkewpie — Mon, 28 Sep 2020 12:36:10 GMT

I'm using this query to graph how many web requests are being logged per second:

index="bigip_ltm" (event=HTTP_REQUEST OR event=HTTP_RESPONSE) client_ip=1.2.3.4 | timechart count(event) by event

But, in line with many questions here, the count() is graphed over a time interval derived from the search period. I've tried many permutations of span=1s, bucket commands etc, but I can't work out how to plot an average one second value over whatever period of time is represented on the graph.

In this question http://splunk-base.splunk.com/answers/46978/average-field-value-per-second the "per_second" data is in the logs, but i want a per_second of the count of the number of logs, so one step further removed.

Re: graphing a logs per second value

Ayn — Wed, 10 Oct 2012 10:11:19 GMT

Maybe this question and its answers can help.

http://splunk-base.splunk.com/answers/10147/how-to-show-events-per-second-in-timechart-regardless-of-span

Re: graphing a logs per second value

acidkewpie — Mon, 28 Sep 2020 12:36:13 GMT

Yeah, that's pretty useful. I thought there needed to be another aggregation stage but couldn't work out what it might be.

I've now got this

index="bigip_ltm" (event=HTTP_REQUEST OR event=HTTP_RESPONSE) client_ip=1.2.3.4 | timechart count by event | timechart per_second(HTTP_REQUEST) per_second(HTTP_RESPONSE)

I don't like having to field values end up as static field names, but I presume that's pretty much unavoidable? There's no way to graph all the "event" values implicitly?

Either way, that's got me what I asked for! thanks!