Hi Team,
I want to calculate peak hourly volume of each month for each service. Each service can have different peak times and first need to calculate peak hour of each component for the month. Likewise calculate for last 3 months. Then calculate the average of 3 months peak hourly volume.
Below table is the sample requirement.
January-24 | February-24 | March-24 | Avg Volume | |
service1 | 20 | 50 | 20 | 30 |
service2 | 4 | 3 | 8 | 5 |
service3 | 20 | 30 | 40 | 30 |
service4 | 30000 | 30000 | 9000 | 23000 |
service5 | 200 | 300 | 400 | 300 |
| bin _time span=1h
| stats count as volume by _time component
| bin _time span=1mon
| chart max(volume) as volume by component _time
| addtotals
| eval Average=Total/3
Thanks @ITWhisperer - It worked for me
| bin _time span=1h
| stats sum(volume) as volume by _time component
| bin _time span=1mon
| chart max(volume) as volume by component _time
| addtotals
| eval Average=Total/3
What is the field used as "volume" ? Is it similar to "count" in stats to get volume ?
I tried this but not working and tried a portion of your query
| bin _time span=1h
| stats sum(count) as volume by _time component
Its not reporting anything under volume
Count is not the same as volume. Unless you have a synthetic field added during ingestion (or use summary indexing), you have to calculate it manually (unfortunately you cannot use tstats for that so it's gonna be costly since every single matching event has to be read and "measured")
index=whatever <your other conditions>
| eval eventlength=len(_raw)
Now you can do some summarizing
| bin _time span=1h
| stats sum(eventlength) as volume by source component whatever
This will give you one hour volumes. Now you can do with it whatever you want. Like the stats @ITWhisperer already posted.
Since you didn't provide any sample events I had to guess - since you still haven't provided any sample events I can only guess whether this is right or not. Since it apparently isn't giving what you want, I would guess it isn't right. In your search, what is count? Is it a field in your events?
This is the sample stats command for my log.
index=company app=abc | stats count by component
I don't have field for volume. We have to calculate volume from the stats count.
| bin _time span=1h
| stats count as volume by _time component
| bin _time span=1mon
| chart max(volume) as volume by component _time
| addtotals
| eval Average=Total/3