Transactions: summing up repeated fields

[twinspop]

I have server farms made up of 4 servers each. I have various stats from each posted once per minute. I want to group them together based on their farm, sum up their stats for each minute, then be able to perform more analysis (perc95, avg, etc) on those aggregated values.

Eg:

12:34:50 host=server1 farm=1 bps=1000 hps=10
12:34:51 host=server2 farm=1 bps=900 hps=9
12:34:51 host=server3 farm=1 bps=1100 hps=10
12:35:02 host=server4 farm=1 bps=1000 hps=9

Combine that into one event using transaction

| transaction farm maxspan=59s

But I need to create a totalBps field equal to 4000 and a totalHps field equal to 38. Then I'd be able to run something like:

| stats perc95(totalBps) by farm

I haven't been able to wrap my head around what's needed to make that possible.

[gkanapathy · Accepted solution]

You don't need transaction. Grouping is best done by stats or timechart, not transaction.

sourcetype=mystatsdata 
| bucket _time span=1m 
| stats sum(bps) as totalbps sum(hps) as totalhps
  by _time,farm 
| stats 
    perc95(totalbps) 
    perc95(totalhps) 
    median(totalhps)
  by farm