How to chart maximum simultaneous (per second) events over larger time ranges

[zkelemen]

My data source resolution is seconds, so I can sonsider "simultaneous" events that are logged with the same second timestamp. Thus each second I would have a number of events.

I want to generate a chart, where each bar would represent the biggest number of events that were logged during one second over the period represented by the bar. Not a sum, not an average and not an average over time. Ex: if each bar represents 4 seconds, and one bar has a count of 100 events with the following per-second event counts: (4,36,60,0), the bar should be 60 high.

I would be looking for something I could describe like

 ... | timechart max(per_second(count))

but that does not work at all (even if I put count in a variable).

... | timechart span=1s count

Sort of works for small timespans, but would fail for spans that need to scale and will hit result limits for larger timespans.

[zkelemen · Accepted solution]

Here's what I have found to work for me, maybe it helps others as well:

... | stats count as eps by _time | timechart max(eps) 

This will output what I've expected, largest number of events per second (and remember, my data source resolution is one second) so this unfortunately may not scale to other applications such as per minute or per hour or if your source's resolution is higher than one second.