graphing a logs per second value

[acidkewpie]

I'm using this query to graph how many web requests are being logged per second:

index="bigip_ltm" (event=HTTP_REQUEST OR event=HTTP_RESPONSE) client_ip=1.2.3.4 | timechart count(event) by event

But, in line with many questions here, the count() is graphed over a time interval derived from the search period. I've tried many permutations of span=1s, bucket commands etc, but I can't work out how to plot an average one second value over whatever period of time is represented on the graph.

In this question http://splunk-base.splunk.com/answers/46978/average-field-value-per-second the "per_second" data is in the logs, but i want a per_second of the count of the number of logs, so one step further removed.

[Ayn · Accepted solution]

Maybe this question and its answers can help.

http://splunk-base.splunk.com/answers/10147/how-to-show-events-per-second-in-timechart-regardless-of...

[acidkewpie]

Yeah, that's pretty useful. I thought there needed to be another aggregation stage but couldn't work out what it might be.

I've now got this

index="bigip_ltm" (event=HTTP_REQUEST OR event=HTTP_RESPONSE) client_ip=1.2.3.4 | timechart count by event | timechart per_second(HTTP_REQUEST) per_second(HTTP_RESPONSE)

I don't like having to field values end up as static field names, but I presume that's pretty much unavoidable? There's no way to graph all the "event" values implicitly?

Either way, that's got me what I asked for! thanks!