https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230603#M68371 <P>Hi, </P> <P>I'm new to Splunk and I'm looking for some help with plotting a timechart to show requests per sec. Thanks in advance. </P> <P>I currently have a dashboard panel that shows transactions (or requests)/second. The user chooses the time range and span from a drop-down and TPS is plotted for that time range. This is the search I'm using. </P> <PRE><CODE>search string | timechart span=$tok_span$ count | timechart per_second(count) </CODE></PRE> <P>This works great, but the search string returns all services grouped under a certain category that is filtered by the url string.</P> <P>Now I need to plot the same metric (TPS) for each service (and there is like 10 of them). I have an eventtype created for each service. </P> <P>My problem is timechart per_second() works only for a single integer value count, but I want to be able to plot this for each service on the same timechart. </P> <P>Any thoughts are greatly appreciated. Thanks!</P> Tue, 16 Aug 2016 18:59:05 GMT pdpsplunk100 2016-08-16T18:59:05Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230603#M68371 <P>Hi, </P> <P>I'm new to Splunk and I'm looking for some help with plotting a timechart to show requests per sec. Thanks in advance. </P> <P>I currently have a dashboard panel that shows transactions (or requests)/second. The user chooses the time range and span from a drop-down and TPS is plotted for that time range. This is the search I'm using. </P> <PRE><CODE>search string | timechart span=$tok_span$ count | timechart per_second(count) </CODE></PRE> <P>This works great, but the search string returns all services grouped under a certain category that is filtered by the url string.</P> <P>Now I need to plot the same metric (TPS) for each service (and there is like 10 of them). I have an eventtype created for each service. </P> <P>My problem is timechart per_second() works only for a single integer value count, but I want to be able to plot this for each service on the same timechart. </P> <P>Any thoughts are greatly appreciated. Thanks!</P> Tue, 16 Aug 2016 18:59:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230603#M68371 pdpsplunk100 2016-08-16T18:59:05Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230604#M68372 <P>You say timechart is only working for a single integer value count, but that's not quite true. Based on your description, you should be able to use a 'by' grouping clause:<BR /> <CODE>... timechart span=$tok_span$ count by service</CODE><BR /> Or am I misunderstanding what you are trying to achieve?</P> Tue, 16 Aug 2016 19:13:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230604#M68372 s2_splunk 2016-08-16T19:13:00Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230605#M68373 <P>Sorry maybe I was not clear. I can do by on the first timechart command and it shows me the timechart by service for the span selected. So if the time range selected was say 4 hours the default span I think is 1 min and so the count is per min but the metric I'm looking for is transactions per second. </P> <P>I'm not able to do timechart per_second(count) by eventtype </P> <P>If I instead just use 1 timechart command after the search like below the # events returned is too high and so gets truncated for a larger window. </P> <P>search | timechart span=1s count </P> Tue, 16 Aug 2016 19:55:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230605#M68373 pdpsplunk100 2016-08-16T19:55:55Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230606#M68374 <P>Give this a try</P> <PRE><CODE>search string | bucket span=$tok_span$ _time | stats count by _time eventtype| timechart per_second(count) by eventtypye </CODE></PRE> Tue, 16 Aug 2016 20:42:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230606#M68374 somesoni2 2016-08-16T20:42:33Z https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230607#M68375 <P>Does exactly what I was looking for. Thanks a bunch! The only thing is, its slow to load when the time range is &gt; 4 hours. I came across summary indexing which may help with performance I think. I will try to explore that. But this is great, thanks again. </P> Tue, 16 Aug 2016 21:08:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-plot-requests-per-second-for-each-service-on-a-single/m-p/230607#M68375 pdpsplunk100 2016-08-16T21:08:37Z