Splunk Search

How to efficiently calculate max events per second (eps) by hour over long timeranges, like 30 days?

the_wolverine
Champion

I could count against the raw data but it takes a long time. How can I more efficiently count on such stats?

1 Solution

the_wolverine
Champion

Use tstats and specify the variables:

  • index=main
  • earliest=-30d
  • groupby (_time, sourcetype)
  • span=1s

    | tstats count as COUNT where index=main earliest=-30d by _time,sourcetype span=1s | timechart span=1h max(COUNT) as eps by sourcetype

View solution in original post

the_wolverine
Champion

Use tstats and specify the variables:

  • index=main
  • earliest=-30d
  • groupby (_time, sourcetype)
  • span=1s

    | tstats count as COUNT where index=main earliest=-30d by _time,sourcetype span=1s | timechart span=1h max(COUNT) as eps by sourcetype

awurster
Contributor

might suggest a reformat (note in my search i do index=*😞

| tstats count as COUNT where index=* earliest=-30d by _time, sourcetype span=1s
  | timechart span=1h max(COUNT) as eps by sourcetype

thambisetty
SplunkTrust
SplunkTrust

FYI -
earliest=-30d and span=1s will produce 1 day = 86400 seconds * 30 days = 2,592,000 

tstats will limit results to 50,000 hence the output of the search will truncate results.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...