Splunk Search

## Calculate Packets per second (PPS) over 1st Quarter

Path Finder

Trying to calculate the Packets per second (PPS) for sourcetype=traffic during the 1st quarter of 2013. Understand the mathematical formula just having problem formulating the right syntax. Can anyone offer some helpful insight?

Logic:

add total packets for 1st quarter - stats count sum(packet_count) divide by seconds in 90 days - /7776000 result should be PPS

This is my progress so far:

index=test sourcetype="traffic" earliest="1/1/2013:00:00:00" latest="4/1/2013:00:00:00" | eval PPS = stats count sum(packet_count)/7776000

Thank you in advance!

Tags (1)
1 Solution
Legend
``````index=test sourcetype="traffic" earliest=-1q@q latest=@q | stats per_second(packet_count) as PPS
``````
Path Finder

I think I just answered my own question with a little insight from Ayn:

index=test sourcetype="traffic" earliest="-1q@q" latest="@q" | stats sum(packet_count) as packets | eval PPS = packets/7776000

Legend
``````index=test sourcetype="traffic" earliest=-1q@q latest=@q | stats per_second(packet_count) as PPS
``````
Path Finder

Thanks for the help... Timechart seems to be a more elegant solution. I was also able to find an answer using the search below your answer (it worked but it's ugly)

Legend

My apologies, I forgot that the `per_second` function is valid for `timechart` only. You could either simply use `timechart`:

``````index=test sourcetype="traffic" earliest=-1q@q latest=@q | timechart span=1q per_second(packet_count) as PPS
``````

Or run `stats` as you originally planned:

``````index=test sourcetype="traffic" earliest=-1q@q latest=@q | stats eval(sum(packet_count)/7776000) as PPS
``````
Path Finder

Ayn, thanks for the quick response, but I am receiving:

Error in 'stats' command: The argument 'per_second(packet_count)' is invalid.

packet_count is a fieldname with a respective value... The reason which I was trying to sum first. Sorry I left that out of my question.

Get Updates on the Splunk Community!

#### Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

#### Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...

#### Splunk Observability Cloud | Enhancing Your Onboarding Experience with the ...

We understand that your initial experience with getting data into Splunk Observability Cloud is crucial as it ...