https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274861#M82918 <P>That's great, there where clause does it. I added an extra bit to handle duplicates where max=Count, so as to take the min(min), max(max) etc of the duplicates before removing the dups.</P> <PRE><CODE>index=web_load sourcetype=instrument | eval Transaction=i_tx.":".i_chn | bucket _time span=1m | stats count as Count, min(i_elapsed) as Min, avg(i_elapsed) as Avg, max(i_elapsed) as Max, perc95(i_elapsed) as 95th by i_tx, Transaction, _time | eventstats max(Count) as Peak by Transaction | where Count=Peak | eventstats min(Min) as Minimum, avg(Avg) as Average, max(Max) as Maximum, max(95th) as P95 by Transaction | fields - Count, Min, Avg, Max, 95th | dedup Transaction, Peak </CODE></PRE> Mon, 08 Feb 2016 23:53:31 GMT bowesmana 2016-02-08T23:53:31Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274857#M82914 <P>I have a log that records a transaction name, channel, and timing information, and need to calculate the maximum rate/minute for each transaction. Something along the lines of </P> <PRE><CODE>index=web_load sourcetype=instrument | eval Transaction=i_tx.":".i_chn | bucket _time span=1m | top 1 _time showperc=false by Transaction </CODE></PRE> <P>but I also want to show the corresponding min, average, max, perc95 elapsed time for that associated minute from the i_elapsed field, something like I can get from </P> <PRE><CODE>index=web_load sourcetype=instrument | eval Transaction=i_tx.":".i_chn | stats count as Count, min(i_elapsed) as Min, avg(i_elapsed) as Avg, max(i_elapsed) as Max, perc95(i_elapsed) as 95th by Transaction </CODE></PRE> <P>How can I get the min/max/avg/perc95 numbers into the table or the rate into the stats table?</P> Mon, 08 Feb 2016 07:40:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274857#M82914 bowesmana 2016-02-08T07:40:50Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274858#M82915 <P>Have you considered using timechart? EG: </P> <PRE><CODE>index=web_load sourcetype=instrument | eval Transaction=i_tx.":".i_chn | timechart span=1m count as tx_per_minute, min(i_elapsed) as Min, avg(i_elapsed) as Avg, max(i_elapsed) as Max, perc95(i_elapsed) as 95th by Transaction </CODE></PRE> Mon, 08 Feb 2016 13:43:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274858#M82915 jplumsdaine22 2016-02-08T13:43:36Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274859#M82916 <P>Yes, I have, but I can have up to 500 different Transaction/channel combinations during a 75 minute test run. That will give me 5 values for each of those 500 transactions for each of 75 minutes in the test (187,500 counters) . I am just after those 5 values for each of the peak rates achieved, so I would need 500 lines with peak rate/min and min, avg, max, p95 for the minute where that peak was reached, i.e. 2,500 in total.</P> <P>My test is divided into sections, where each 'source' will indicate the test phase and different transactions occur during each phase.</P> Mon, 08 Feb 2016 21:38:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274859#M82916 bowesmana 2016-02-08T21:38:04Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274860#M82917 <P>Try something like this</P> <PRE><CODE>index=web_load sourcetype=instrument | eval Transaction=i_tx.":".i_chn | bucket _time span=1m | stats count as Count, min(i_elapsed) as Min, avg(i_elapsed) as Avg, max(i_elapsed) as Max, perc95(i_elapsed) as 95th by _time Transaction | eventstats max(Count) as max by Transaction | where max=Count | fields - max </CODE></PRE> Mon, 08 Feb 2016 22:25:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274860#M82917 somesoni2 2016-02-08T22:25:33Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274861#M82918 <P>That's great, there where clause does it. I added an extra bit to handle duplicates where max=Count, so as to take the min(min), max(max) etc of the duplicates before removing the dups.</P> <PRE><CODE>index=web_load sourcetype=instrument | eval Transaction=i_tx.":".i_chn | bucket _time span=1m | stats count as Count, min(i_elapsed) as Min, avg(i_elapsed) as Avg, max(i_elapsed) as Max, perc95(i_elapsed) as 95th by i_tx, Transaction, _time | eventstats max(Count) as Peak by Transaction | where Count=Peak | eventstats min(Min) as Minimum, avg(Avg) as Average, max(Max) as Maximum, max(95th) as P95 by Transaction | fields - Count, Min, Avg, Max, 95th | dedup Transaction, Peak </CODE></PRE> Mon, 08 Feb 2016 23:53:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-peak-rate-of-certain-transactions-as-well-as/m-p/274861#M82918 bowesmana 2016-02-08T23:53:31Z