I need to show first 40 events pear seconds in the range 15 minutes.
... | sort _time
| eval seconds=floor(_time)
| streamstats count by seconds
| where count <= 40
For example, if 100 events fell in one second, I need to only take the first 40 and continue with the next second
Assuming your search is over a 15 minute period, round time to seconds, and count events by second, then only keep the first 40 per second
... | eval seconds=round(_time,0)
| streamstats count by seconds
| where count <= 40
Thanks for respond but I see to look more 40 events pear second:
| dedup id | eval seconds=round(_time,0)
| streamstats count by seconds | where count <= 40 | timechart span=1s count
Does sorting by time first help?
... | sort _time
| eval seconds=round(_time,0)
| streamstats count by seconds
| where count <= 40
keeps showing results greater than 40 😞
... | sort _time
| eval seconds=floor(_time)
| streamstats count by seconds
| where count <= 40