VIEW n events pear second

[gbriones]

I need  to show first 40 events pear seconds in the range 15 minutes.

[gbriones]

For example, if 100 events fell in one second, I need to only take the first 40 and continue with the next second

[ITWhisperer]

Assuming your search is over a 15 minute period, round time to seconds, and count events by second, then only keep the first 40 per second

... | eval seconds=round(_time,0)
| streamstats count by seconds
| where count <= 40

[gbriones]

Thanks for respond but  I see to look more 40 events pear second:

| dedup id | eval seconds=round(_time,0)
| streamstats count by seconds | where count <= 40 | timechart span=1s count

gbriones_0-1618416601195.png

[ITWhisperer]

Does sorting by time first help?

... | sort _time
| eval seconds=round(_time,0)
| streamstats count by seconds
| where count <= 40

[gbriones]

keeps showing results greater than 40 😞

[ITWhisperer · Accepted solution]

... | sort _time
| eval seconds=floor(_time)
| streamstats count by seconds
| where count <= 40