https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141627#M39255 <P>I think that something like this could help him<BR /> Please martin_mueller could you help to verify in your side ?<BR /> index="_introspection" | timechart per_second(data.localTime) as X| streamstats current=t global=f window=2 range(X) as X1</P> Mon, 28 Sep 2020 19:28:05 GMT chimell 2020-09-28T19:28:05Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141621#M39249 <P>I'm trying to use <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Streamstats">streamstats</A> on Splunk 6.2.2.255606 and the per_second stats-function is killing me. I'm trying to find the delta per second of an incrementing counter. Here's an example using some data from the introspection log.</P> <P>This one works and gives me the delta between the two events (I need it per second):</P> <PRE><CODE>index="_introspection"| streamstats current=t global=f window=2 range(data.localTime) as X </CODE></PRE> <P>but when I try the same thing to get the per_second value Splunk throws an error:</P> <PRE><CODE>index="_introspection"| streamstats current=t global=f window=2 per_second(data.localTime) as X_per_second </CODE></PRE> <P>Error in 'streamstats' command: The argument 'per_second(data.localTime)' is invalid.</P> <P>A work around is to get the time delta and calculate the per_second value using an eval:</P> <PRE><CODE>index="_introspection" | streamstats current=t global=f window=2 range(data.localTime) as X_range range(_time) as time_delta | eval X_per_second=X_range/time_delta </CODE></PRE> <P>but that makes my searches messy and I would really like to use the per_second stats-function if I can.</P> <P>Has anyone successfully got the streamstats per_second function working? Am I missing something obvious here?</P> Sun, 12 Apr 2015 01:39:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141621#M39249 Skippy 2015-04-12T01:39:38Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141622#M39250 <P><CODE>per_second()</CODE> is only applicable to <CODE>timechart</CODE>, see <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonStatsFunctions</A> for reference.</P> Sun, 12 Apr 2015 06:29:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141622#M39250 martin_mueller 2015-04-12T06:29:50Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141623#M39251 <P>Hi Skippy<BR /> As martin_mueller told , per_second() function is easily applicable to timechart command .Therefore , you can use a subsearch use timechart and per_second() function before use streamstats command</P> Mon, 28 Sep 2020 19:31:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141623#M39251 chimell 2020-09-28T19:31:04Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141624#M39252 <P>How would you replace <CODE>streamstats</CODE> with <CODE>timechart</CODE>?</P> Mon, 13 Apr 2015 11:28:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141624#M39252 martin_mueller 2015-04-13T11:28:39Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141625#M39253 <P>Hi martin_mueller<BR /> I say that you can use timechart and streamstats in the same request , you make sure that timechart command come before streamstats : look at an example <BR /> ... | timechart span=1h sum(value) as total by category | streamstats<BR /> global=f sum(total) as accu_total</P> Mon, 28 Sep 2020 19:31:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141625#M39253 chimell 2020-09-28T19:31:09Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141626#M39254 <P>How can that approach be applied to the question at hand, calculating "per_second(data.localTime)"?</P> Mon, 13 Apr 2015 14:55:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141626#M39254 martin_mueller 2015-04-13T14:55:40Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141627#M39255 <P>I think that something like this could help him<BR /> Please martin_mueller could you help to verify in your side ?<BR /> index="_introspection" | timechart per_second(data.localTime) as X| streamstats current=t global=f window=2 range(X) as X1</P> Mon, 28 Sep 2020 19:28:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-per-second-function-with-streamstats/m-p/141627#M39255 chimell 2020-09-28T19:28:05Z