Security

stats after per_second function

deepak02
Path Finder

Hi,

I have a search query that looks like this,

<filter conditions> 
| eval count=1 
| timechart per_second(count) as TPS 
| eval TransactionPerSecond=max(TPS)  
| stats max(TransactionPerSecond) by source, sourcetype, fieldA, fieldB

What I am trying to do is split the 'Transactions per Second' value by source, sourcetype, fieldA and fieldB.

The stats part of it is not giving me any results.

Are there any other ways to implement the above logic?

Thanks,
Deepak

Tags (1)
0 Karma

woodcock
Esteemed Legend

Do it like this:

index=_*
| eval count=1, fieldA=host, fieldB=date_hour

| rename COMMENT AS "Everything above generates sample data (do for 'Last 200 seconds'); everything below is your solution"

| eval multi_key = source . "::" . sourcetype . "::" . fieldA . "::" . fieldB
| timechart span=1s per_second(count) BY multi_key
| untable _time multi_key TPS
| rex field=multi_key "^(?<source>.*?)::(?<sourcetype>.*?)::(?<fieldA>.*?)::(?<fieldB>.*)$"
| stats max(TPS) BY source sourcetype fieldA fieldB

micahkemp
Champion

I think this would give you max transactions per second:

<base search> 
| bin span=1s _time
| stats count as TPS by source, sourcetype, fieldA, fieldB, _time
| stats max(TPS) by source, sourcetype, fieldA, fieldB
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...