https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318130#M95203 <P>How to calculate how many seconds already run in my search? That is what I want.</P> Fri, 24 Feb 2017 23:42:06 GMT abzmhzsplunk 2017-02-24T23:42:06Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318126#M95199 <P>for the search </P> <PRE><CODE>index=* some_events | stats count </CODE></PRE> <P>how to calculate the transaction per second for this search (how to get how many seconds for the search job)? <BR /> tried to use <CODE>|addinfo | eval t=info_max_time - info_min_time</CODE> but couldn't get it to work.<BR /> please help.<BR /> thanks.</P> Fri, 24 Feb 2017 19:44:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318126#M95199 abzmhzsplunk 2017-02-24T19:44:34Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318127#M95200 <P>Are you trying to calculate, for your search, number of rows in the base search/time it took to execute; OR just for your events, how many events are coming to your indexes per second (count/time range in secs)?</P> Fri, 24 Feb 2017 21:07:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318127#M95200 somesoni2 2017-02-24T21:07:04Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318128#M95201 <P>Here is what I tried<BR /> index=* | addinfo | eval t=info_max_time - info_min_time | stats count as ct | eval tps=ct/t |table ct, tps</P> <P>I want to find out total count for the search and the time of the search, then calculate tps="total count" / "time in seconds for the search"</P> Tue, 29 Sep 2020 13:01:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318128#M95201 abzmhzsplunk 2020-09-29T13:01:54Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318129#M95202 <P><CODE>addinfo</CODE> doesn't tell you anything about how long it took your search to run - it gives some access to information about your search, but not that.</P> <P>An administrator can tell how long a search ran by looking in the _audit index like this</P> <PRE><CODE>index=_audit action=search user!="splunk-system-user" info=completed | table user search_id total_run_time exec_time scan_count event_count _time </CODE></PRE> <P>I used the table just to show an example of the results...</P> Fri, 24 Feb 2017 22:48:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318129#M95202 lguinn2 2017-02-24T22:48:32Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318130#M95203 <P>How to calculate how many seconds already run in my search? That is what I want.</P> Fri, 24 Feb 2017 23:42:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318130#M95203 abzmhzsplunk 2017-02-24T23:42:06Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318131#M95204 <P>Try this</P> <PRE><CODE>index=* | addinfo | eval t=info_max_time - info_min_time | stats count as ct max(t) as t | eval tps=ct/t |table ct, tps </CODE></PRE> Fri, 24 Feb 2017 23:44:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-transaction-per-second-for-my-search/m-p/318131#M95204 somesoni2 2017-02-24T23:44:37Z