https://community.splunk.com/t5/Splunk-Search/Search-query-for-permon-counter/m-p/157249#M44257 <P>You can use "|sort 0 host, counter, Value" to sort more than 10000 rows.</P> Thu, 09 Oct 2014 14:43:22 GMT somesoni2 2014-10-09T14:43:22Z https://community.splunk.com/t5/Splunk-Search/Search-query-for-permon-counter/m-p/157248#M44256 <P>Hi All,</P> <P>we had configured splunk to get the perfmon counter data from server (every 5mins). The counter value gets reset frequently. </P> <P>We found that raw data is not coming in the Order (time sorted). And some time the counter value is getting incremented with in second as shown below. we cann't use sort . it limits for 10,000 (as per standard conf). we are receiving more then 10 lak events per day in perfmon </P> <P>data is comes like below per sec </P> <PRE><CODE>Date Server counter Value 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3932 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3929 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3937 </CODE></PRE> <P>Expected : </P> <P>We are expecting as below.</P> <PRE><CODE>Date Server counter Value 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3937 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3932 09_29_2014_00_47_36 WTPCPJLKVS69 Messages Processed 3929 </CODE></PRE> <P>We are using Stream stats to calculate the total capture message per day.</P> <P>Query:</P> <PRE><CODE>index=win_srv_perf (object="XXXXXXXXXXX") counter="XXXXXXXXXX" host="XXXXXXXXXX"| eval Time = strftime(_time,"%m_%d_%Y_%H_%M_%S") | streamstats current=f last(Value) as newValue by host counter | eval msgDiff=(if(newValue&gt;=Value,newValue-Value,newValue)) | table Time DumID host counter Value newValue msgDiff | stats sum(msgDiff) as value by host counter </CODE></PRE> Thu, 09 Oct 2014 12:41:03 GMT https://community.splunk.com/t5/Splunk-Search/Search-query-for-permon-counter/m-p/157248#M44256 rsathish47 2014-10-09T12:41:03Z https://community.splunk.com/t5/Splunk-Search/Search-query-for-permon-counter/m-p/157249#M44257 <P>You can use "|sort 0 host, counter, Value" to sort more than 10000 rows.</P> Thu, 09 Oct 2014 14:43:22 GMT https://community.splunk.com/t5/Splunk-Search/Search-query-for-permon-counter/m-p/157249#M44257 somesoni2 2014-10-09T14:43:22Z https://community.splunk.com/t5/Splunk-Search/Search-query-for-permon-counter/m-p/157250#M44258 <P>Thanks Somesoni2.. It worked </P> Mon, 13 Oct 2014 06:05:46 GMT https://community.splunk.com/t5/Splunk-Search/Search-query-for-permon-counter/m-p/157250#M44258 rsathish47 2014-10-13T06:05:46Z