Security

stats after per_second function

deepak02
Path Finder

Hi,

I have a search query that looks like this,

<filter conditions> 
| eval count=1 
| timechart per_second(count) as TPS 
| eval TransactionPerSecond=max(TPS)  
| stats max(TransactionPerSecond) by source, sourcetype, fieldA, fieldB

What I am trying to do is split the 'Transactions per Second' value by source, sourcetype, fieldA and fieldB.

The stats part of it is not giving me any results.

Are there any other ways to implement the above logic?

Thanks,
Deepak

Tags (1)
0 Karma

woodcock
Esteemed Legend

Do it like this:

index=_*
| eval count=1, fieldA=host, fieldB=date_hour

| rename COMMENT AS "Everything above generates sample data (do for 'Last 200 seconds'); everything below is your solution"

| eval multi_key = source . "::" . sourcetype . "::" . fieldA . "::" . fieldB
| timechart span=1s per_second(count) BY multi_key
| untable _time multi_key TPS
| rex field=multi_key "^(?<source>.*?)::(?<sourcetype>.*?)::(?<fieldA>.*?)::(?<fieldB>.*)$"
| stats max(TPS) BY source sourcetype fieldA fieldB

micahkemp
Champion

I think this would give you max transactions per second:

<base search> 
| bin span=1s _time
| stats count as TPS by source, sourcetype, fieldA, fieldB, _time
| stats max(TPS) by source, sourcetype, fieldA, fieldB
0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...