topic Re: Thruput search help in Splunk Search

Thruput search help

carmackd — Fri, 04 Feb 2011 22:07:31 GMT

I've got a search that will display max daily thruput over the last 30 days.

index="_internal" source="/*/metrics.log" per_index_thruput series="*" daysago=30 | eval gb=kb/1024/1024 | timechart sum(gb) as sumGB | stats max(sumGB) as MaxThru

The output looks like this:

MaxThru
80.0

I would like the search to include the date, but cannot figure out how to do it using | stats max()

Ideally the output would look like:

Date                      MaxThru
2/4/11 12:00:00.000 AM    80

Any suggestions would be greatly appreciated!

Thanks

Re: Thruput search help

Ayn — Fri, 04 Feb 2011 22:37:13 GMT

You could achieve what you want by using a combination of sort and head:

index="_internal" source="/*/metrics.log" per_index_thruput series="*" daysago=30 | eval gb=kb/1024/1024 | timechart sum(gb) as sumGB | sort - sumGB | head 1

Re: Thruput search help

carmackd — Sat, 05 Feb 2011 02:53:13 GMT

Perfect! thanks