Filtering out servers

[bgeshk]

I'm trying to filter out servers that aren't getting a lot of traffic. So, I'm wondering how to filter out servers that are getting less than 10 requests per minute.

Right now, I'm getting the transactions per second of each JVM on all the servers:

index=att_prod_ecomm_open-api_rest sourcetype=att_openapi_access_log NOT "/openapi-rest-web/index.html" | bucket _time span=1s | stats count by _time | stats avg(count) as Average_TPS | appendcols [search index=att_prod_ecomm_open-api_rest sourcetype=att_openapi_access_log NOT "/openapi-rest-web/index.html" | stats count by source | stats count as jvm] | eval final = Average_TPS/jvm | gauge final

But i want to disregard the servers that get less than 10 requests per minute. Thanks!

[somesoni2]

Try like this

index=att_prod_ecomm_open-api_rest sourcetype=att_openapi_access_log NOT "/openapi-rest-web/index.html" | bucket _time span=1s | eval temp_time=_time | bucket span=1m temp_time | eventstats count by temp_time source | where count>=10| stats dc(source) as jvm count  by _time | eval avg=count/jvm | stats avg(avg) as Average_TPS| gauge Average_TPS

[bgeshk]

Thank you very much. That makes a lot more sense!