Splunk Search

How can I show average, peak, and peak time in a single search?

wierling
New Member

Hi, my first post..I'm trying to display in a search the Average TPS (transactions per second), along with Peak TPS, along with timestamp that peak TPS occurred at in a 1 hour window.
Example:
AvgTPS | PeakTPS | PeakTime
100 | 500 | 11:05:15

I can get the values in separate searches, but can't seem to combine them into a single table result as above.

Here is the search that gets Average and Peak TPS:

index=test | timechart span=1m count(index) AS TPM | eval TPS=TPM/60 | stats avg(TPS) as avgTPS, max(TPS) as peakTPS

Here's the search that gets Peak TPS and Time peak occurred:

index=test | timechart span=1m count(index) AS TPM | eval peakTPS=TPM/60 | table peakTPS _time | sort peakTPS desc | head 1

How can I get the results in a single search?
Thanks,
-Bob

0 Karma
1 Solution

lguinn2
Legend

Try this!

index=test 
| timechart span=1s count AS TPS
| eventstats max(TPS) as peakTPS
| eval peakTime=if(peakTPS==TPS,_time,null())
| stats avg(TPS) as avgTPS first(peakTPS) as peakTPS first(peakTime) as peakTime
| fieldformat peakTime=strftime(peakTime,"%x %X")

The eventstats command calculates the peakTPS and then the following eval command determines when that peakTPS occurred.

View solution in original post

lguinn2
Legend

Try this!

index=test 
| timechart span=1s count AS TPS
| eventstats max(TPS) as peakTPS
| eval peakTime=if(peakTPS==TPS,_time,null())
| stats avg(TPS) as avgTPS first(peakTPS) as peakTPS first(peakTime) as peakTime
| fieldformat peakTime=strftime(peakTime,"%x %X")

The eventstats command calculates the peakTPS and then the following eval command determines when that peakTPS occurred.

wierling
New Member

That worked! Thanks for quick reply and solution.

0 Karma
Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...