Splunk Search

## Calculate Packets per second (PPS) over 1st Quarter

Path Finder

Trying to calculate the Packets per second (PPS) for sourcetype=traffic during the 1st quarter of 2013. Understand the mathematical formula just having problem formulating the right syntax. Can anyone offer some helpful insight?

Logic:

add total packets for 1st quarter - stats count sum(packet_count) divide by seconds in 90 days - /7776000 result should be PPS

This is my progress so far:

index=test sourcetype="traffic" earliest="1/1/2013:00:00:00" latest="4/1/2013:00:00:00" | eval PPS = stats count sum(packet_count)/7776000

Tags (1)
1 Solution
Legend
``````index=test sourcetype="traffic" earliest=-1q@q latest=@q | stats per_second(packet_count) as PPS
``````
Path Finder

I think I just answered my own question with a little insight from Ayn:

index=test sourcetype="traffic" earliest="-1q@q" latest="@q" | stats sum(packet_count) as packets | eval PPS = packets/7776000

Legend
``````index=test sourcetype="traffic" earliest=-1q@q latest=@q | stats per_second(packet_count) as PPS
``````
Path Finder

Thanks for the help... Timechart seems to be a more elegant solution. I was also able to find an answer using the search below your answer (it worked but it's ugly)

Legend

My apologies, I forgot that the `per_second` function is valid for `timechart` only. You could either simply use `timechart`:

``````index=test sourcetype="traffic" earliest=-1q@q latest=@q | timechart span=1q per_second(packet_count) as PPS
``````

Or run `stats` as you originally planned:

``````index=test sourcetype="traffic" earliest=-1q@q latest=@q | stats eval(sum(packet_count)/7776000) as PPS
``````
Path Finder

Ayn, thanks for the quick response, but I am receiving:

Error in 'stats' command: The argument 'per_second(packet_count)' is invalid.

packet_count is a fieldname with a respective value... The reason which I was trying to sum first. Sorry I left that out of my question.

Get Updates on the Splunk Community!

Novice observability practitioners are often overly obsessed with performance. They might approach ...

#### Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

#### The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...