So my based search can produce a table stats of deployment, total hit, and time_seconds, I only need one more field that calculate TPS (total_hit/time_seconds). If it's not grouped by, it can produce the TPS. The challenge how to do it if it's grouped by.
base search
| rex ".*wm-(?<deployment>.*?)-"
| addinfo
| eval t=info_max_time - info_min_time
| stats count as hit max(t) as time_seconds by deployment
It resulted in this table. The time_seconds shows 3600 because the date_picker was set to 60 minutes
deployment | hit | time_seconds |
a | 2506 | 3609.000 |
b | 30285 | 3609.000 |
c | 2213 | 3609.000 |
Actually I only need to get the tps (calculated by hit/time) table which is:
deployment | tps |
a | ... |
b | ... |
c | ... |
Any idea to produce this. thanks.
PS. already browse through the community but failed to find
@qmail_madrid - Try this:
base search
| rex ".*wm-(?<deployment>.*?)-"
| stats count as hit by deployment
| addinfo
| eval t=info_max_time - info_min_time
| eval tps=hit/t
I hope this helps!! Consider upvoting!!
Thanks for your reply. I'd love to upvote it and unfortunately it does not addressed my desired result.
Of course to count tps we can use eval hit/t. But how to present it in pair of deployment and its each tps.
If it's not grouped by deployment, we can easily use this script
base search
| rex ".*wm-(?<deployment>.*?)-"
| addinfo
| eval t=info_max_time - info_min_time
| stats count max(t) as time_seconds
| eval TPS=count/time_seconds
| table TPS
it resulted as (for example)
tps |
..... |
@qmail_madrid - I may not be understanding you correctly but:
Based on the TPS definition, my query logic seems correct.
Also, addinfo is the same value always so whether you do it after stats or before stats, or you use max() or avg() no difference. Hence performance wise it's suitable to do it after the stats command.
And if you apply that query, you will reach the logic I mentioned in my original response.