peakTPS for every one hour in last 24 hours

[appusplunk14]

i am trying to find out peakTPS for every one hour in last 24 hours duration, i have below query but thats giving peak TPS only for one hour , how do i run that loop that query for entire 24 hours duration but need results for every one hour.

index=whatever |timechart span=1s count AS TPS avg(RT) as Avg_RT | eventstats max(TPS) as peakTPS | eval peakTime=if(peakTPS==TPS,_time,null()) | stats avg(TPS) as avgTPS first(peakTPS) as peakTPS first(peakTime) as peakTime |eval peakTPS=round(peakTPS,2), avgTPS=round(avgTPS,2) |table avgTPS peakTPS peakTime |convert timeformat="%Y-%m-%d %H:%M:%S %Z" ctime(peakTime) as peakTime

[scelikok]

Hi @appusplunk14,

Below query will show peakTime too. 

index=whatever
| bin _time span=1s 
| chart count as TPS by _time 
| eval time_hour=strftime(_time,"%Y-%m-%d %H:00:00") 
| eventstats max(TPS) as peakTPS avg(TPS) as avgTPS by time_hour 
| eval avgTPS=round(avgTPS,2)
| where TPS=peakTPS 
| rename _time as peakTime, time_hour as _time 
| eval peakTime=strftime(peakTime,"%Y-%m-%d %H:%M:%S") 
| stats values(peakTime) as peakTime values(peakTPS) as peakTPS values(avgTPS) as avgTPS by _time

[appusplunk14]

thanks it worked , i would like to print peak time as well , is that possible?

[scelikok · Accepted solution]

Hi @appusplunk14,

You can use the below query.  

index=whatever 
| bin _time span=1s 
| chart count as TPS by _time 
| timechart max(TPS) as peakTPS eval(round(avg(TPS),2)) as avgTPS span=1h

If this reply helps you, an upvote is appreciated.  

[appusplunk14]

can you please help me to update query to get peak time as well ?

[appusplunk14]

any update on peakTime?