Splunk Search

timechart per_second working.

deepak02
Path Finder

Hi,

I found a query I could not understand:
| eval foo=1 | timechart per_second(foo) as "Bytes per second"

Why set foo to 1 and then pass it in?

Ref: https://answers.splunk.com/answers/10147/how-to-show-events-per-second-in-timechart-regardless-of-sp...

Can anyone pls explain?

Thanks,
Deepak

Tags (1)
0 Karma

DalJeanis
Legend

The main thing to understand is that there is a search before that far left pipe symbol, that is selecting some number of records, each of which has a _time field representing when it was indexed.

Therefore, the timechart command is receiving a set of records that have _time and foo=1. timechart is calculating the sum of the foo values per second, and displaying them on a whatever basis it thinks is best. For short time periods, it will be second-by-second, amounting to the sum of the foos.

Thus, in that case, that code snippet is the equivalent of the much simpler...

your search | timechart count as "Bytes per second" 

Across a longer time range, it will calculate the AVERAGE SUM of the foos per second across each chunk of time span that timechart chooses to display.

It can be forced to make more sense, however, if you manually set the span value and name the field correctly ...

your search | eval foo=1 | timechart span=5m per_second(foo) as "Transactions per second" 
0 Karma

somesoni2
Revered Legend

That query provides number of events with per_second aggregation. You create a field foo with value 1, so that each event will have that field and you can calculate per_second count of events on this numerical data.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...