Difference between per_second and span=1s in timec...

Splunk Search

Hi all,

We are trying to show the bytes/s, averaged over 15 mins. I'm getting far lower results if I use per_second than a live timechart with a span of 1s, so:

index="datafeed" | where isnotnull(bytes) | timechart span=15m per_second(bytes)

Gives an average of 10mb/s

Whereas:

index="datafeed" | where isnotnull(bytes) | timechart span=1s sum(bytes)

Shows the data constantly hovering around the 100mb/s mark, so the 15 min average must be up at that level. Am I missing something obvious?

Thanks for any pointers!

Get Updates on the Splunk Community!

Vibe-coding, AI, and Splunkcraft: Highlights from the .conf26 Builder Bar

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...