Need to get a sample size of 5000 events to calculate mean and Standerddeviation for each day fro last 60 days, so in order to get get a random sample of 5000 events and calculating total events and then div is the floor (totalevents/5000) Then as I get this, I am picking each event based on div (like 12 before). I am able to get it like this: your base search | eval sno=1 | accum sno | eventstats count as totalEvents |eval div=floor(totalEvents /5000) |where floor(sno/div)=(sno/div) | head 5000| timechart span=1d avg(filedx) stddev(filedx).. Is there anything wrong with this search? ... View more

Below is the example of the events in table So when you a stats i need like trans1 as 4 , trans2 as 5 , trans3 as 1 , the count combined from filed a and field b ingoring ERR and Res from these fileds. and also i want o do some avg on resptimeinsecs accordingly.. thanks in advance. Event Flied A FliedB Source resptimeinsecs 1 Trans1 Res CP 10 2 Trans2 Res CP 45 3 Err Trans3 CP 67 4 Trans1 Res CP 91 5 Err Trans2 CP 78 6 Trans2 Res CP 86 7 Trans1 Res CP 90 8 Trans2 Res CP 86 9 Err Trans1 CP 90 10 Trans2 Res CP 86 ... View more

For 1:60 sampling, add date_second = 42 to your search. Any other second will do. To check if this gives you a reasonable sampling, you could run statistics by second to see if there are any outliers, e.g. lots of events generated at the second zero from cronjobs. You really should first consider running over your entire data set though. 60000 events over 24 hours really isn't that much if you have reference-spec hardware or better. ... View more