How to get Transactions per second from the following table(table 1). I also have a table which gets me the per second transactions and avg. How can I use the table with average values (table 2)
The following search gives me the Table 1
index=cams component=uas sourcetype="forgerock:auth" o=sco | where message_desc = "Authentication Failed"| chart count over instance by message_desc | rename "Authentication Failed" as "Number of transactions"
Table 1:
Following is the table 2 which I have which has the average of field values for each transaction type(Authentication failed) by instance viz., 11,12,21,22
Like this:
index=cams component=uas sourcetype="forgerock:auth" o=sco | where message_desc = "Authentication Failed"| chart count over instance by message_desc | rename "Authentication Failed" as "Number of transactions" | addinfo | eval TransactionsPerSecond = $Number of transactions$/(info_max_time - info_min_time) | fields - info_*
If you are using All-time
the other answer won't work so try this one:
index=cams component=uas sourcetype="forgerock:auth" o=sco message_desc = "Authentication Failed"
| chart count min(_time) AS info_min_time max(_time) AS info_max_time BY Instance
| eval TransactionsPerSecond = count/(info_max_time - info_min_time)
| rename count AS "Number of transactions"
| fields - info_*
Gregg...sorry ..my bad..... i guess the "BY" command had to be a lower case...I changed that and it worked.
Gregg....I see no difference in the output...I still get just the Instance and Number of Transactions. no luck with the TPS.
Also, I was able to get the Avg number of transactions per second/instance. How do I get the TPS over any time range?
The eventstats was in the wrong place. I edited my answer (and made your stuff more efficient). Try it again.
Thanks Gregg...Unfortunately I get "No results" for any time range I select
Like this:
index=cams component=uas sourcetype="forgerock:auth" o=sco | where message_desc = "Authentication Failed"| chart count over instance by message_desc | rename "Authentication Failed" as "Number of transactions" | addinfo | eval TransactionsPerSecond = $Number of transactions$/(info_max_time - info_min_time) | fields - info_*
Thanks Gregg...
not sure what I should be using duration for.? it gives me an error at "duration"
Sorry, that was a typo. I have fixed it in the original answer; try it again.
Ok...thanks ...but I get info- max time as Infinity and info min time -0.00
Your requirement is unclear. What exactly you're trying to do? Could you share your expect result/format?
All I am trying to do is get a TPS(transactions per second) for the following table ( link below). I already have the "NUmber of transactions per instance namely 11, 12, 21, 21 and I am looking to get the TPS for 11,12,21,22 over any time range.
I managed to get a table ( second table) which averages the Transactions by instance, but how do i get the TPS out of this. I would prefer to use the first table and get the TPS or the second table can also be used to derive TPS out of the average for each instance