Splunk Search

How to chart maximum simultaneous (per second) events over larger time ranges

zkelemen
Explorer

My data source resolution is seconds, so I can sonsider "simultaneous" events that are logged with the same second timestamp. Thus each second I would have a number of events.

I want to generate a chart, where each bar would represent the biggest number of events that were logged during one second over the period represented by the bar. Not a sum, not an average and not an average over time. Ex: if each bar represents 4 seconds, and one bar has a count of 100 events with the following per-second event counts: (4,36,60,0), the bar should be 60 high.

I would be looking for something I could describe like

 ... | timechart max(per_second(count))

but that does not work at all (even if I put count in a variable).

... | timechart span=1s count

Sort of works for small timespans, but would fail for spans that need to scale and will hit result limits for larger timespans.

0 Karma
1 Solution

zkelemen
Explorer

Here's what I have found to work for me, maybe it helps others as well:

... | stats count as eps by _time | timechart max(eps) 

This will output what I've expected, largest number of events per second (and remember, my data source resolution is one second) so this unfortunately may not scale to other applications such as per minute or per hour or if your source's resolution is higher than one second.

View solution in original post

zkelemen
Explorer

Here's what I have found to work for me, maybe it helps others as well:

... | stats count as eps by _time | timechart max(eps) 

This will output what I've expected, largest number of events per second (and remember, my data source resolution is one second) so this unfortunately may not scale to other applications such as per minute or per hour or if your source's resolution is higher than one second.

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...