How to find the RequestPerSec by Country using ClientIP adddress ?

[sangs8788]

Hi

I have a query which would list me avg, max & P95 requestpersec for the selected time range

  index=test  client_ipaddress=* |eval requestcount=1 | timechart per_second(requestcount) AS RequestPerSec
     | eventstats max(RequestPerSec) as peakRequestPerSec
     | eval peakTime=if(peakRequestPerSec==RequestPerSec,_time,null())
     | timechart span=1m avg(RequestPerSec) as avgRequestPerSec max(RequestPerSec) as peakRequestPerSec p95(RequestPerSec) as p95RequestPerSec
     | fieldformat peakTime=strftime(peakTime,"%m/%y %H:%M") | eval avgRequestPerSec=round(avgRequestPerSec,2) | eval peakRequestPerSec=round(peakRequestPerSec,2)| eval p95RequestPerSec=round(p95RequestPerSec,2)|rename avgRequestPerSec as "Average Requests/Sec" peakRequestPerSec as "Max Requests/Sec" p95RequestPerSec as "P95 Requests/Sec"

The question here is, Can i show Requestpersec by country using the field client_ipaddress present in the events ? How do i do that ? Please let me know

[renjith_nair · Accepted solution]

@sangs8788,

You could use iplocation command for that.
E.g.

index=test  client_ipaddress=* |iplocation client_ipaddress|fields requestcount,Country|eval requestcount=1 | timechart per_second(requestcount) AS RequestPerSec by Country

[sangs8788]

@renjith.nair This would work to display by Country. Thanks. But Is it possible to display using Chart command ?

index=data | eval wall_time = round(wall_time/1000,2) | eval Latency=case(wall_time<500, "0-0.5s", wall_time>=500 AND wall_time<1000, "0.5s-1s",wall_time>=1000 AND wall_time<3000, "1s-3s", wall_time>=3000 AND wall_time<6000, "3s-6s",wall_time>=4000 AND wall_time<10000, "6s-10s",wall_time>=10000 AND wall_time<30000, "10s-30s", wall_time>=30000, ">=30s")
| iplocation client_ipaddress |fields requestcount,Country | eval requestcount=1 |  chart per_second(requestcount) AS RequestPerSec over Country  by  Latency

Looks like Chart command doesnt allow per_second. Is there a way to display something like below

Country | 0-0.5s | 0.5s-1s | 1s-3s | 3s-6s | 6s-10s | 10s-30s | >30s
India | 3 | 5 | 6| 7 | 7|5 |1 |0