I'm trying to use streamstats on Splunk 22.214.171.124606 and the per_second stats-function is killing me. I'm trying to find the delta per second of an incrementing counter. Here's an example using some data from the introspection log.
This one works and gives me the delta between the two events (I need it per second):
index="_introspection"| streamstats current=t global=f window=2 range(data.localTime) as X
but when I try the same thing to get the per_second value Splunk throws an error:
index="_introspection"| streamstats current=t global=f window=2 per_second(data.localTime) as X_per_second
Error in 'streamstats' command: The argument 'per_second(data.localTime)' is invalid.
A work around is to get the time delta and calculate the per_second value using an eval:
index="_introspection" | streamstats current=t global=f window=2 range(data.localTime) as X_range range(_time) as time_delta | eval X_per_second=X_range/time_delta
but that makes my searches messy and I would really like to use the per_second stats-function if I can.
Has anyone successfully got the streamstats per_second function working? Am I missing something obvious here?
As martin_mueller told , per_second() function is easily applicable to timechart command .Therefore , you can use a subsearch use timechart and per_second() function before use streamstats command
I think that something like this could help him
Please martin_mueller could you help to verify in your side ?
index="_introspection" | timechart per_second(data.localTime) as X| streamstats current=t global=f window=2 range(X) as X1
I say that you can use timechart and streamstats in the same request , you make sure that timechart command come before streamstats : look at an example
... | timechart span=1h sum(value) as total by category | streamstats
global=f sum(total) as accu_total