Hello @scelikok, Thank you for responding ! Please find below an event sample. {"BackendAddr":"10.0.19.45:8080","BackendName":"backend-<servicename>","BackendURL":{"Scheme":"http","Opaque":"","User":null,"Host":"10.0.19.45:8080","Path":"","RawPath":"","ForceQuery":false,"RawQuery":"","Fragment":""},"ClientAddr":"10.255.0.38:47741","ClientHost":"10.255.0.38","ClientPort":"47741","ClientUsername":"-","DownstreamContentSize":100574,"DownstreamStatus":200,"DownstreamStatusLine":"200 OK","Duration":95292255,"FrontendName":"PathPrefix-<servicename>","OriginContentSize":100574,"OriginDuration":95016703,"OriginStatus":200,"OriginStatusLine":"200 OK","Overhead":275552,"RequestAddr":"example.domain.com","RequestContentSize":0,"RequestCount":266290620,"RequestHost":"example.domain.com","RequestLine":"GET /<Request> HTTP/1.1","RequestMethod":"GET","RequestPath":"/<Request>","RequestPort":"-","RequestProtocol":"HTTP/1.1","RetryAttempts":0,"StartLocal":"2021-03-23T19:19:51.901899656-07:00","downstream_Content-Type":"application/json","downstream_Date":"Wed, 24 Mar 2021 02:19:51 GMT","level":"info","msg":"","origin_Content-Type":"application/json","origin_Date":"Wed, 24 Mar 2021 02:19:51 GMT","request_Content-Type":"application/json","request_X-Device-Type":"Handheld with SIM","request_X-Transaction-Id":"OAbYkrBVYFip0fc8azAQg","time":"2021-03-23T19:19:51-07:00"} I have verified that "_time" and "time" had the same value by executing below query. The monitor input is reading the "time" field as timestamp. "index=myindex sourcetype=access_log | table time _time StartLocal" Also, as you said, I was able to get the a result using below query. "index=myindex sourcetype=access_log RequestAddr=*.domain.com | timechart span=1s count as TPS by RequestAddr" Hoping this is an accurate way to know how much transactions the application is handling per second. Thanks !
... View more