Dashboards & Visualizations
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: Need help with Spunk query calculating TPS var...
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
shashankk
Communicator
06-22-2023
12:00 PM
The below query is giving the results for 30 days MaxTPS data. (Between the time range of 2:00 to 4:00)
index=<search_strings> earliest=-30d@d date_hour>=2 AND date_hour<4
| timechart span=120m count(eval(searchmatch("sent"))) as HotCountToday
| eval TPS=round(HotCountToday/(120*60),2)
| eval Day=strftime(_time, "%Y-%m-%d")
| stats max(TPS) as MaxTPS by DayNow I want to calculate the "MaxTPS Variance" for complete 30 days. Calculate the percentage MaxTPS variance between "Today's value to last week's value" (and so on) and show the MaxTPS variance percentage. (Example: Monday to last week Monday; Sunday to last week Sunday and so on)
I am new to Splunk and still learning. Looking forward to hear from you. Kindly suggest how this can be achieved.
@ITWhisperer @bowesmana @xpac
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ITWhisperer
SplunkTrust
06-24-2023
11:13 PM
index=<search_strings>
| rex "(?<TestMQ>*)"
| timechart span=120m aligntime=earliest count(eval(searchmatch("sent"))) as HotCountToday by TestMQ
| untable _time TestMQ HotCountToday
| eval TPS=round(HotCountToday/(120*60),2)
| eval Day=strftime(_time,"%Y-%m-%d")
| stats max(TPS) as MaxTPS by Day TestMQ
| xyseries Day TestMQ MaxTPS
| streamstats list(*) as * window=8
| foreach *
[| eval <<FIELD>>=if("<<FIELD>>"="Day",mvindex(Day,-1),if(mvcount('<<FIELD>>')<8,null(),case(mvindex('<<FIELD>>',0)>mvindex('<<FIELD>>',7),round(100*(tonumber(mvindex('<<FIELD>>',0))-tonumber(mvindex('<<FIELD>>',7)))/tonumber(mvindex('<<FIELD>>',0)),2),mvindex('<<FIELD>>',0)<mvindex('<<FIELD>>',7),round(100*(tonumber(mvindex('<<FIELD>>',7))-tonumber(mvindex('<<FIELD>>',0)))/tonumber(mvindex('<<FIELD>>',7)),2),1==1,round(0,2))))]
| transpose 0 column_name=Name header_field=Day- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
shashankk
Communicator
06-24-2023
10:45 PM
Yes, the expected output would have multiple rows with different TestMQ names. And the requirement is to show MaxTPS variance for each TestMQ names.
I agree on my mistake - I could have been more specific while sharing the initial requirement.
Requesting you to suggest what different approach can be tried here?
Thank you for your understanding. 🙂
Best Regards!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
shashankk
Communicator
06-22-2023
09:29 PM
Expected Output as below:
| TestMQ | 2023-06-23 | 2023-06-22 | 2023-06-21 | 2023-06-20 | 2023-06-19 | 2023-06-18 | 2023-06-17 | 2023-06-16 | And so on - till 30 days |
| MQ.NAME | 5.003 | 17.004 | 25.775 | 19.882 | 32.114 | 56.881 | 10.991 | 85.114 | .... |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
shashankk
Communicator
06-22-2023
12:06 PM
Current Output:
| Day | MaxTPS |
| 2023-05-23 | 1.40 |
| 2023-05-22 | 1.10 |
| and so on | |
| 2023-06-22 | 1.34 |
Get Updates on the Splunk Community!
See your relevant APM services, dashboards, and alerts in one place with the updated ...
As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...
Index This | What goes away as soon as you talk about it?
May 2025 Edition
Hayyy Splunk Education Enthusiasts and the Eternally Curious!
We’re back with this month’s ...
What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025
This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...
