timechart per_second working.

[deepak02]

Hi,

I found a query I could not understand:
| eval foo=1 | timechart per_second(foo) as "Bytes per second"


Why set foo to 1 and then pass it in?

Ref: https://answers.splunk.com/answers/10147/how-to-show-events-per-second-in-timechart-regardless-of-sp...

Can anyone pls explain?

Thanks,
Deepak

[DalJeanis]

The main thing to understand is that there is a search before that far left pipe symbol, that is selecting some number of records, each of which has a _time field representing when it was indexed.

Therefore, the timechart command is receiving a set of records that have _time and foo=1. timechart is calculating the sum of the foo values per second, and displaying them on a whatever basis it thinks is best. For short time periods, it will be second-by-second, amounting to the sum of the foos.

Thus, in that case, that code snippet is the equivalent of the much simpler...

your search | timechart count as "Bytes per second" 

Across a longer time range, it will calculate the AVERAGE SUM of the foos per second across each chunk of time span that timechart chooses to display.

It can be forced to make more sense, however, if you manually set the span value and name the field correctly ...

your search | eval foo=1 | timechart span=5m per_second(foo) as "Transactions per second" 

[somesoni2]

That query provides number of events with per_second aggregation. You create a field foo with value 1, so that each event will have that field and you can calculate per_second count of events on this numerical data.