stats after per_second function

Path Finder


I have a search query that looks like this,

<filter conditions> 
| eval count=1 
| timechart per_second(count) as TPS 
| eval TransactionPerSecond=max(TPS)  
| stats max(TransactionPerSecond) by source, sourcetype, fieldA, fieldB

What I am trying to do is split the 'Transactions per Second' value by source, sourcetype, fieldA and fieldB.

The stats part of it is not giving me any results.

Are there any other ways to implement the above logic?


Tags (1)
0 Karma

Esteemed Legend

Do it like this:

| eval count=1, fieldA=host, fieldB=date_hour

| rename COMMENT AS "Everything above generates sample data (do for 'Last 200 seconds'); everything below is your solution"

| eval multi_key = source . "::" . sourcetype . "::" . fieldA . "::" . fieldB
| timechart span=1s per_second(count) BY multi_key
| untable _time multi_key TPS
| rex field=multi_key "^(?<source>.*?)::(?<sourcetype>.*?)::(?<fieldA>.*?)::(?<fieldB>.*)$"
| stats max(TPS) BY source sourcetype fieldA fieldB


I think this would give you max transactions per second:

<base search> 
| bin span=1s _time
| stats count as TPS by source, sourcetype, fieldA, fieldB, _time
| stats max(TPS) by source, sourcetype, fieldA, fieldB
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...