Splunk Search

Events per second on a realtime search?

pde23
Explorer

How can I get a count of events per second in a realtime search?

I can do something like this to get a rolling count on a realtime search with a 30 second window:

source=foobar.log host=*prod* PAYLOAD | stats count

But as soon as I add something like |eval eps=max(count/30) it all falls apart and eps doesn't seem to get updated.

For bonus points I'd like to display this in a single value panel with a rangemap...

Thanks

-Pete

Tags (1)
0 Karma

pde23
Explorer

So weird. It didn't work the first two times I tried it, then I walked away for a coffee and it's working as expected. Thanks.

gkanapathy
Splunk Employee
Splunk Employee

Coffee sometimes does that.

gkanapathy
Splunk Employee
Splunk Employee

Seems to work just fine for me:

index=_* OR index=* | stats count | eval eps=count/30

(Note that you don't need max(), but it should give the same results anyway.)

Get Updates on the Splunk Community!

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

[Puzzles] Solve, Learn, Repeat: Nested loops in Event Conversion

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...