calculate call per second (CPS) from call detail records

[HansK]

Hi,

I have records like:

epoch_millisecond|field2|field3|field4|field5|switchID|field7|field8|field9|field10|field11|field12
1375354799977|SIGNALING|dyn-edge-1|860|INAP|3120220016|3110340945|104514444|653444474|INAP|6040|D061108 1375354799963|SIGNALING|dan-edge-1|409|INAP|3120220013|3110340945|492444444|610844440|INAP|3002|D061108

I need to create a report which will tell me how many records per second per switchID.

I tried: index="titan" | timechart per_second(switchID)

But that's not giving the results i need.

[HansK]

looks like I found it :
index="titan" | eval count=1 | timechart per_second(count) as transactions_per_second by SwitchID

it's slow though, can I speed it up in any way?

[msarro]

My best suggestion is to use summary indexing periodically. If you want it in realtime, you're going to need to optimize splunk as much as possible. I also recommend setting up index-time field extraction to help too.