Splunk Search

subquery to get average throughput

rakesh_498115
Motivator

Hi ,

I need to find the average throughput of the sales transaction.ie no of requests /no of responses * 100 .. so i have used the subsearch like this ..but couldnt get the results..

soucetype="X" POST [ soucetype="X" GET | stats count as TotalReq ] | stats count as TotalRes | eval Throughput=(TotalReq*100)/TotalRes | table Throughput

But this didnt work..need help on this..

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

the approach you're intuitively looking for is more like the 'appendcols' param.

What your current subsearch will do, in a literal sense, is add the following search term to the 'outer' search: TotalReq="117", which is not going to be useful.

However, what you want to do instead of using any kind of square bracket syntax, is extract the values GET and POST from the raw events (they may already be extracted as a field called 'method', and then things get much easier.

For example, this will automatically give you a percent column:

sourcetype="X" | top method

but if you want to generate things more manually, you can still do things like this:

sourcetype="X" | eventstats count as totalCount | stats first(totalCount) as totalCount count by method | eval throughput=count*100/totalCount

The eventstats and streamstats commands are both useful for places where you feel like you need to process the data twice, places where often people reach out to subsearches and append/join initially.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...