Splunk Search

how do I calculate peaks with concurrent events?

whisperstream
Explorer

I have a bunch of log entries that look roughly like this:

[07/07/12:21:01:00 -0800] relay="12.12.12.12" endtime="07/07/12:21:03:00 -0800" duration="120" datarate="6"
[07/07/12:21:00:00 -0800] relay="12.12.12.12" endtime="07/07/12:21:07:00 -0800" duration="420" datarate="1"
[07/07/12:20:58:00 -0800] relay="12.12.12.12" endtime="07/07/12:21:01:15 -0800" duration="195" datarate="5"
[07/07/12:21:03:10 -0800] relay="12.12.12.12" endtime="07/07/12:21:03:20 -0800" duration="10" datarate="8"

What I am trying to do is find the peak bandwidth rate in each 5 minute bucket. I have tried using the timechart and concurrency but I not able to figure out how to account for the overlapping events and how to accumulate the datarate for each entry.

In the data above the max data rate for the 5 minute block shown, should be 12 (6 + 1 + 5), because the 1st 3 events overlap for 15 seconds (21:01:00 - 21:01:15).

If I can get the above 1st part done, the 2nd part is to find the average peak of all the 5 min buckets.

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You have to use the concurrency command before the timechart command like:

... | concurrency duration=duration | timechart max(concurrency)
0 Karma

whisperstream
Explorer

Thanks for the response, maybe I'm not quite sure how concurrency works. I entered what you suggested and get concurrency values between 1-9 for various times. Am a bit confused on what this values represents because if I drill down into the data, it shows a few events but by manually checking the timestamps they don't seem to line up, so am wondering how splunk counts them as concurrent?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!