How can I get a count of events per second in a realtime search?
I can do something like this to get a rolling count on a realtime search with a 30 second window:
source=foobar.log host=*prod* PAYLOAD | stats count
But as soon as I add something like |eval eps=max(count/30) it all falls apart and eps doesn't seem to get updated.
For bonus points I'd like to display this in a single value panel with a rangemap...
So weird. It didn't work the first two times I tried it, then I walked away for a coffee and it's working as expected. Thanks.
Coffee sometimes does that.
Seems to work just fine for me:
index=_* OR index=* | stats count | eval eps=count/30
(Note that you don't need max(), but it should give the same results anyway.)