Splunk Search

how to get Transactions per second based on average values for each instance

jkalra
Explorer

How to get Transactions per second from the following table(table 1). I also have a table which gets me the per second transactions and avg. How can I use the table with average values (table 2)
The following search gives me the Table 1
index=cams component=uas sourcetype="forgerock:auth" o=sco | where message_desc = "Authentication Failed"| chart count over instance by message_desc | rename "Authentication Failed" as "Number of transactions"

Table 1:
alt text

Following is the table 2 which I have which has the average of field values for each transaction type(Authentication failed) by instance viz., 11,12,21,22
alt text

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=cams component=uas sourcetype="forgerock:auth" o=sco | where message_desc = "Authentication Failed"| chart count over instance by message_desc | rename "Authentication Failed" as "Number of transactions" | addinfo | eval TransactionsPerSecond = $Number of transactions$/(info_max_time - info_min_time) | fields - info_*

View solution in original post

woodcock
Esteemed Legend

If you are using All-time the other answer won't work so try this one:

index=cams component=uas sourcetype="forgerock:auth" o=sco message_desc = "Authentication Failed"
| chart count min(_time) AS info_min_time max(_time) AS info_max_time BY Instance
| eval TransactionsPerSecond = count/(info_max_time - info_min_time)
| rename count AS "Number of transactions"
| fields - info_*

jkalra
Explorer

Gregg...sorry ..my bad..... i guess the "BY" command had to be a lower case...I changed that and it worked.

0 Karma

jkalra
Explorer

Gregg....I see no difference in the output...I still get just the Instance and Number of Transactions. no luck with the TPS.
Also, I was able to get the Avg number of transactions per second/instance. How do I get the TPS over any time range?

0 Karma

woodcock
Esteemed Legend

The eventstats was in the wrong place. I edited my answer (and made your stuff more efficient). Try it again.

0 Karma

jkalra
Explorer

Thanks Gregg...Unfortunately I get "No results" for any time range I select

0 Karma

woodcock
Esteemed Legend

Like this:

index=cams component=uas sourcetype="forgerock:auth" o=sco | where message_desc = "Authentication Failed"| chart count over instance by message_desc | rename "Authentication Failed" as "Number of transactions" | addinfo | eval TransactionsPerSecond = $Number of transactions$/(info_max_time - info_min_time) | fields - info_*

jkalra
Explorer

Thanks Gregg...
not sure what I should be using duration for.? it gives me an error at "duration"

0 Karma

woodcock
Esteemed Legend

Sorry, that was a typo. I have fixed it in the original answer; try it again.

0 Karma

jkalra
Explorer

Ok...thanks ...but I get info- max time as Infinity and info min time -0.00

0 Karma

somesoni2
Revered Legend

Your requirement is unclear. What exactly you're trying to do? Could you share your expect result/format?

0 Karma

jkalra
Explorer

All I am trying to do is get a TPS(transactions per second) for the following table ( link below). I already have the "NUmber of transactions per instance namely 11, 12, 21, 21 and I am looking to get the TPS for 11,12,21,22 over any time range.

I managed to get a table ( second table) which averages the Transactions by instance, but how do i get the TPS out of this. I would prefer to use the first table and get the TPS or the second table can also be used to derive TPS out of the average for each instance

https://answers.splunk.com/storage/temp/134206-1.png

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...