How to use the per_second function with streamstats?

[Skippy]

I'm trying to use streamstats on Splunk 6.2.2.255606 and the per_second stats-function is killing me. I'm trying to find the delta per second of an incrementing counter. Here's an example using some data from the introspection log.

This one works and gives me the delta between the two events (I need it per second):

index="_introspection"| streamstats current=t global=f window=2 range(data.localTime) as X

but when I try the same thing to get the per_second value Splunk throws an error:

index="_introspection"| streamstats current=t global=f window=2 per_second(data.localTime) as X_per_second

Error in 'streamstats' command: The argument 'per_second(data.localTime)' is invalid.

A work around is to get the time delta and calculate the per_second value using an eval:

index="_introspection" | streamstats current=t global=f window=2 range(data.localTime) as X_range range(_time) as time_delta  | eval X_per_second=X_range/time_delta

but that makes my searches messy and I would really like to use the per_second stats-function if I can.

Has anyone successfully got the streamstats per_second function working? Am I missing something obvious here?

[chimell]

Hi Skippy
As martin_mueller told , per_second() function is easily applicable to timechart command .Therefore , you can use a subsearch use timechart and per_second() function before use streamstats command

[martin_mueller]

How can that approach be applied to the question at hand, calculating "per_second(data.localTime)"?

[chimell]

I think that something like this could help him
Please martin_mueller could you help to verify in your side ?
index="_introspection" | timechart per_second(data.localTime) as X| streamstats current=t global=f window=2 range(X) as X1

[martin_mueller]

How would you replace streamstats with timechart?

[chimell]

Hi martin_mueller
I say that you can use timechart and streamstats in the same request , you make sure that timechart command come before streamstats : look at an example
... | timechart span=1h sum(value) as total by category | streamstats
global=f sum(total) as accu_total

[martin_mueller]

per_second() is only applicable to timechart, see http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/CommonStatsFunctions for reference.