Summary Index search problems

[twinspop]

My scheduled search:

[Summary Logins Per Second]
action.summary_index = 1
action.summary_index._name = lgn-stats
cron_schedule = 10 5-17 * * 1-5
dispatch.earliest_time = -15m@m
dispatch.latest_time = -5m@m
displayview = flashtimeline
enableSched = 1
realtime_schedule = 0
request.ui_dispatch_view = flashtimeline
search = SYSCODE=LGN-*  | sitop _time
vsid = gc6frvm6

After running through a few cycles this morning, I ran this search:

index=lgn-stats search_name="Summary Logins Per Second" | top _time

Our app is particularly busy at the top of the hour. I'm trying to grab the busiest seconds at the top 10 minutes of every hour (X:55:00 - Y:05:00) for monthly reporting. However, the SI search above is returning total events for the entire 10 minutes as the top entries, followed by the top seconds that I really want. Example:

time count percent
1   8/2/10 5:55:00.000 AM   55770   inf
2   8/2/10 6:55:00.000 AM   34025   inf
3   8/2/10 4:55:00.000 AM   24479   inf
4   8/2/10 5:56:59.000 AM   155 inf
5   8/2/10 6:00:05.000 AM   144 inf
6   8/2/10 5:58:40.000 AM   137 inf
7   8/2/10 5:59:30.000 AM   136 inf
8   8/2/10 5:58:42.000 AM   134 inf
9   8/2/10 6:00:12.000 AM   131 inf
10  8/2/10 5:59:25.000 AM   128 inf

Apparently I've misunderstood something basic about the SI command set. Any tips?

Thanks, Jon

[dskillman · Accepted solution]

I think the search you want is:

SYSCODE=LGN-* | timechart count span=1s

This will return the # of matching events in 1 second buckets, or whatever bucket you want. Try it without the si. You can sort it by count to find the 'second' that has the most events.

If it works then just tack on the sitimechart and use that recurring search to fill your summary.

SYSCODE=LGN-* | sitimechart count span=1s

[twinspop]

Yeah, that's what I've ended up doing. I was trying avoid large result collections, only wanting to keep the top X results each time. (Not exactly what I wanted, but good enough for a check mark.)

Thanks!