topic Re: Calculate Packets per second (PPS) over 1st Quarter in Splunk Search

Calculate Packets per second (PPS) over 1st Quarter

Adrian — Fri, 19 Apr 2013 18:37:08 GMT

Trying to calculate the Packets per second (PPS) for sourcetype=traffic during the 1st quarter of 2013. Understand the mathematical formula just having problem formulating the right syntax. Can anyone offer some helpful insight?

Logic:

add total packets for 1st quarter - stats count sum(packet_count) divide by seconds in 90 days - /7776000 result should be PPS

This is my progress so far:

index=test sourcetype="traffic" earliest="1/1/2013:00:00:00" latest="4/1/2013:00:00:00" | eval PPS = stats count sum(packet_count)/7776000

Thank you in advance!

Re: Calculate Packets per second (PPS) over 1st Quarter

Ayn — Fri, 19 Apr 2013 18:42:07 GMT

index=test sourcetype="traffic" earliest=-1q@q latest=@q | stats per_second(packet_count) as PPS

Re: Calculate Packets per second (PPS) over 1st Quarter

Adrian — Mon, 28 Sep 2020 13:46:07 GMT

Ayn, thanks for the quick response, but I am receiving:

Error in 'stats' command: The argument 'per_second(packet_count)' is invalid.

packet_count is a fieldname with a respective value... The reason which I was trying to sum first. Sorry I left that out of my question.

Re: Calculate Packets per second (PPS) over 1st Quarter

Adrian — Fri, 19 Apr 2013 19:12:05 GMT

I think I just answered my own question with a little insight from Ayn:

index=test sourcetype="traffic" earliest="-1q@q" latest="@q" | stats sum(packet_count) as packets | eval PPS = packets/7776000

Re: Calculate Packets per second (PPS) over 1st Quarter

Ayn — Fri, 19 Apr 2013 19:17:33 GMT

My apologies, I forgot that the per_second function is valid for timechart only. You could either simply use timechart:

index=test sourcetype="traffic" earliest=-1q@q latest=@q | timechart span=1q per_second(packet_count) as PPS

Or run stats as you originally planned:

index=test sourcetype="traffic" earliest=-1q@q latest=@q | stats eval(sum(packet_count)/7776000) as PPS

Re: Calculate Packets per second (PPS) over 1st Quarter

Adrian — Fri, 19 Apr 2013 21:22:46 GMT

Thanks for the help... Timechart seems to be a more elegant solution. I was also able to find an answer using the search below your answer (it worked but it's ugly)