Splunk Search

Calculate max Transaction per second per day

tmurray3
Path Finder

I am trying to figure out how to calculate the highest number of transaction per second for a given day. I would like the output to print the time and count. For example, at 10/11/2013 12:30:33 pm, 45 TPS

I cannot seem to figure out the query.

Thanks in advance for your help.

Tags (3)
0 Karma

the_wolverine
Champion

Use tstats if possible for performance:

| tstats count where index=APPAUTH earliest=-1w by _time span=1s | timechart span=1d max(count)
0 Karma

kristian_kolb
Ultra Champion

You can shorten the calculation a bit to;

index=appauth AUTH earliest=-1w | bucket _time span=1s | top 1 _time by date_mday | fields - percent, date_mday

Just change the earliest value as needed.

/K

0 Karma

tmurray3
Path Finder

I figured out how to calculate the max tps for a given day using the following query

index=appauth AUTH earliest=-1d|bucket _time span=1s|stats count by _time|sort by count,time DESC limit=1

However, I would also like to display the max tps per day over a week.

Any ideas?

0 Karma

manidandu
Explorer

Hi,

Do you have any resolution for this? Please post if you have any sample query.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...

Federated Search for Dynamic Data Self Storage Is Now Generally Available on Splunk ...

 Splunk is excited to announce the General Availability of Federated Search for Dynamic Data Self Storage ...

Index This | What has many keys but can’t unlock a door?

July 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...