topic Events per second on a realtime search? in Splunk Search

Events per second on a realtime search?

pde23 — Mon, 16 Aug 2010 02:14:38 GMT

How can I get a count of events per second in a realtime search?

I can do something like this to get a rolling count on a realtime search with a 30 second window:

source=foobar.log host=*prod* PAYLOAD | stats count

But as soon as I add something like |eval eps=max(count/30) it all falls apart and eps doesn't seem to get updated.

For bonus points I'd like to display this in a single value panel with a rangemap...

Thanks

-Pete

gkanapathy — Mon, 16 Aug 2010 02:28:53 GMT

Seems to work just fine for me:

index=_* OR index=* | stats count | eval eps=count/30

(Note that you don't need max(), but it should give the same results anyway.)

pde23 — Mon, 16 Aug 2010 02:38:24 GMT

So weird. It didn't work the first two times I tried it, then I walked away for a coffee and it's working as expected. Thanks.

gkanapathy — Mon, 16 Aug 2010 08:35:40 GMT

Coffee sometimes does that.