stats after per_second function

[deepak02]

Hi,

I have a search query that looks like this,

<filter conditions> 
| eval count=1 
| timechart per_second(count) as TPS 
| eval TransactionPerSecond=max(TPS)  
| stats max(TransactionPerSecond) by source, sourcetype, fieldA, fieldB

What I am trying to do is split the 'Transactions per Second' value by source, sourcetype, fieldA and fieldB.

The stats part of it is not giving me any results.

Are there any other ways to implement the above logic?

Thanks,
Deepak

[woodcock]

Do it like this:

index=_*
| eval count=1, fieldA=host, fieldB=date_hour

| rename COMMENT AS "Everything above generates sample data (do for 'Last 200 seconds'); everything below is your solution"

| eval multi_key = source . "::" . sourcetype . "::" . fieldA . "::" . fieldB
| timechart span=1s per_second(count) BY multi_key
| untable _time multi_key TPS
| rex field=multi_key "^(?<source>.*?)::(?<sourcetype>.*?)::(?<fieldA>.*?)::(?<fieldB>.*)$"
| stats max(TPS) BY source sourcetype fieldA fieldB

[micahkemp]

I think this would give you max transactions per second:

<base search> 
| bin span=1s _time
| stats count as TPS by source, sourcetype, fieldA, fieldB, _time
| stats max(TPS) by source, sourcetype, fieldA, fieldB