When you are in search can you pipe the HTTPSum and HTTP into a table to show the value?
something like this?
| eval HTTPSum = count/3600| stats count by HTTPSum Code
Here is an example of my events:
I need to sum the count over a Period of one hour and find the Transaction per second by dividing the sum(count) by 3600
Start Time In MS=1479738420000,Start Time Local=Mon Nov 21 14:27:00 GMT+00:00 2016,End Time In MS=1479738480000,End Time Local=Mon Nov 21 14:28:00 GMT+00:00 2016,Site=W0,Group=HTTP,SourceIP=127.0.0.1,Status=200,URL=http://127.0.0.1:8080/xmlapi/invoke,Count=24,Rate=0.4,Average Latency=1.29166
Unfortunately I already tried this,
eval HTTPSum = count/3600| pivot Statistics HTTP sum(HTTPSum) as "TPS" SPLITROW _time AS _time PERIOD hour
I'm still getting the error:
Error in 'PivotCell': The object 'HTTP' has no field 'HTTPSum'.
| pivot Statistics HTTP sum(count) as HTTPSum SPLITROW _time AS _time PERIOD hour | eval HTTPSum = HTTPSum/3600
pivot commands, you can only use
SPLITROW and other
pivot related options in the pipeline with the
I tried your suggestion but pivot still doesn't like it. I get this error 😞 :
Error in 'PivotCell': The object 'HTTP' has no field '|'.
Any work around would be appreciated.
I need to sum the count over a Period of one hour and find the Transaction per second by dividing the sum(count) by 3600. Following your suggestion, I tried this bu it didn't work. Still getting errors:
| pivot Statistics HTTP sum(count) as HTTPSum | eval HTTPSum = 'HTTPSum'/3600 SPLITROW _time AS _time PERIOD hour