Splunk Search

How to plot requests per second for each service on a single timechart irrespective of the span chosen

pdpsplunk100
Path Finder

Hi,

I'm new to Splunk and I'm looking for some help with plotting a timechart to show requests per sec. Thanks in advance.

I currently have a dashboard panel that shows transactions (or requests)/second. The user chooses the time range and span from a drop-down and TPS is plotted for that time range. This is the search I'm using.

search string | timechart span=$tok_span$ count | timechart per_second(count) 

This works great, but the search string returns all services grouped under a certain category that is filtered by the url string.

Now I need to plot the same metric (TPS) for each service (and there is like 10 of them). I have an eventtype created for each service.

My problem is timechart per_second() works only for a single integer value count, but I want to be able to plot this for each service on the same timechart.

Any thoughts are greatly appreciated. Thanks!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

search string | bucket span=$tok_span$ _time | stats count by _time eventtype| timechart per_second(count)  by eventtypye

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Give this a try

search string | bucket span=$tok_span$ _time | stats count by _time eventtype| timechart per_second(count)  by eventtypye

pdpsplunk100
Path Finder

Does exactly what I was looking for. Thanks a bunch! The only thing is, its slow to load when the time range is > 4 hours. I came across summary indexing which may help with performance I think. I will try to explore that. But this is great, thanks again.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

You say timechart is only working for a single integer value count, but that's not quite true. Based on your description, you should be able to use a 'by' grouping clause:
... timechart span=$tok_span$ count by service
Or am I misunderstanding what you are trying to achieve?

0 Karma

pdpsplunk100
Path Finder

Sorry maybe I was not clear. I can do by on the first timechart command and it shows me the timechart by service for the span selected. So if the time range selected was say 4 hours the default span I think is 1 min and so the count is per min but the metric I'm looking for is transactions per second.

I'm not able to do timechart per_second(count) by eventtype

If I instead just use 1 timechart command after the search like below the # events returned is too high and so gets truncated for a larger window.

search | timechart span=1s count

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...