Reporting

calculate call per second (CPS) from call detail records

HansK
Path Finder

Hi,

I have records like:

epoch_millisecond|field2|field3|field4|field5|switchID|field7|field8|field9|field10|field11|field12
1375354799977|SIGNALING|dyn-edge-1|860|INAP|3120220016|3110340945|104514444|653444474|INAP|6040|D061108 1375354799963|SIGNALING|dan-edge-1|409|INAP|3120220013|3110340945|492444444|610844440|INAP|3002|D061108

I need to create a report which will tell me how many records per second per switchID.

I tried: index="titan" | timechart per_second(switchID)

But that's not giving the results i need.

0 Karma

HansK
Path Finder

looks like I found it :
index="titan" | eval count=1 | timechart per_second(count) as transactions_per_second by SwitchID

it's slow though, can I speed it up in any way?

0 Karma

msarro
Builder

My best suggestion is to use summary indexing periodically. If you want it in realtime, you're going to need to optimize splunk as much as possible. I also recommend setting up index-time field extraction to help too.

0 Karma
Get Updates on the Splunk Community!

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...