i am trying to find out peakTPS for every one hour in last 24 hours duration, i have below query but thats giving peak TPS only for one hour , how do i run that loop that query for entire 24 hours duration but need results for every one hour.
index=whatever |timechart span=1s count AS TPS avg(RT) as Avg_RT | eventstats max(TPS) as peakTPS | eval peakTime=if(peakTPS==TPS,_time,null()) | stats avg(TPS) as avgTPS first(peakTPS) as peakTPS first(peakTime) as peakTime |eval peakTPS=round(peakTPS,2), avgTPS=round(avgTPS,2) |table avgTPS peakTPS peakTime |convert timeformat="%Y-%m-%d %H:%M:%S %Z" ctime(peakTime) as peakTime
Hi @appusplunk14,
You can use the below query.
index=whatever
| bin _time span=1s
| chart count as TPS by _time
| timechart max(TPS) as peakTPS eval(round(avg(TPS),2)) as avgTPS span=1h
If this reply helps you, an upvote is appreciated.
Hi @appusplunk14,
Below query will show peakTime too.
index=whatever
| bin _time span=1s
| chart count as TPS by _time
| eval time_hour=strftime(_time,"%Y-%m-%d %H:00:00")
| eventstats max(TPS) as peakTPS avg(TPS) as avgTPS by time_hour
| eval avgTPS=round(avgTPS,2)
| where TPS=peakTPS
| rename _time as peakTime, time_hour as _time
| eval peakTime=strftime(peakTime,"%Y-%m-%d %H:%M:%S")
| stats values(peakTime) as peakTime values(peakTPS) as peakTPS values(avgTPS) as avgTPS by _time
thanks it worked , i would like to print peak time as well , is that possible?
Hi @appusplunk14,
You can use the below query.
index=whatever
| bin _time span=1s
| chart count as TPS by _time
| timechart max(TPS) as peakTPS eval(round(avg(TPS),2)) as avgTPS span=1h
If this reply helps you, an upvote is appreciated.
can you please help me to update query to get peak time as well ?
any update on peakTime?