Activity Feed
- Got Karma for how to show a moving average in the recent 30days about the top concurrency count per second in each day. 06-05-2020 12:45 AM
- Got Karma for how to show a moving average in the recent 30days about the top concurrency count per second in each day. 06-05-2020 12:45 AM
- Got Karma for how to show a moving average in the recent 30days about the top concurrency count per second in each day. 06-05-2020 12:45 AM
- Posted Re: how to show a moving average in the recent 30days about the top concurrency count per second in each day on Splunk Search. 05-28-2010 02:55 AM
- Posted Re: how to show a moving average in the recent 30days about the top concurrency count per second in each day on Splunk Search. 05-27-2010 10:16 AM
- Posted how to show a moving average in the recent 30days about the top concurrency count per second in each day on Splunk Search. 05-19-2010 08:16 AM
- Tagged how to show a moving average in the recent 30days about the top concurrency count per second in each day on Splunk Search. 05-19-2010 08:16 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 3 |
05-28-2010
02:55 AM
Hi gkanapathy,
I just counted the requests by using grep from the log file directly, seems you are right the first expression wasn't give the right answer here, so i have two questions for you:
a).why the first one is wrong, i'm stupid and i use it was because i saw an example from the document
"Return the average "thruput" of each
"host" for each 5 minute time span.
... | bucket _time span=5m | stats
avg(thruput) by _time host"
so i think use it can put all events into discrete sets by using 1sec as time range, and then doing count for each set should get the right answer. ( i knew i didn't consider the ReqTime for calculating concurrency, however in my opinion, the result should match with the "grep")
b). If the second one is right, how can i set the range to 1 sec instead of 10 minutes
_time max(concurrency)
1 5/16/10 5:**50**:00.000 PM 111
2 5/16/10 5:**40**:00.000 PM 141
and what's the unit of "duration"? the unit of ReqTime is msec in our system.
thanks
Jason
... View more
05-27-2010
10:16 AM
Hi Guys,
Thanks for your quick responses!
I just got a chance to try "concurrency" in my local, however the result wasn't make sense to me, the case i was using for testing is
"Showing the max concurrency count in second level of day '05/16/2010'"
and i tried to use two expression to figure it out:
index=main Type=API earliest=05/16/2010:6:0:0 latest=05/16/2010:18:0:0 | bucket _time span=1s | stats count(_raw) by _time | sort -count(_raw) | head 1
_time count(_raw)
1 5/16/10 5:35:36.000 PM 28
index=main Type=API earliest=05/16/2010:6:0:0 latest=05/16/2010:18:0:0 | concurrency duration=ReqTime | timechart max(concurrency)
_time
max(concurrency) 1 5/16/10 6:00:00.000
AM 47
...
the result was different, i'm not sure which one is right, do you think the expression i used is make sense?
Thanks
Jason
... View more
05-19-2010
08:16 AM
3 Karma
Hello,
We are using Splunk to monitor the traffic of our system, and i was asked to give a report for showing the moving maximum concurrency count in second level of the recent 30 days, for example:
day-1
**_time=5/9/10 12:00:01,Type=UI, ReqTime=100
_time=5/9/10 12:00:01,Type=UI, ReqTime=1
_time=5/9/10 12:00:01,Type=UI, ReqTime=30
_time=5/9/10 12:00:01,Type=UI, ReqTime=9**
_time=5/9/10 12:00:02,Type=UI, ReqTime=5
There are 4 concurrency requests at "5/9/10 12:00:01"
day-2
_time=5/10/10 1:00:01,Type=UI, ReqTime=3
_time=5/10/10 1:00:01,Type=UI, ReqTime=2
_time=5/10/10 1:00:01,Type=UI, ReqTime=50
_time=5/10/10 12:00:01,Type=UI, ReqTime=0
_time=5/10/10 12:00:02,Type=UI, ReqTime=1
There are 3 concurrency requests at "5/10/10 1:00:01"
...
day -30
I want to have chart like this:
Day Max concurrency count per second Time
5/9/2010 4 5/9/10 12:00:01
5/10/2010 3 5/10/10 1:00:01
...
thanks in advance!
Jason
... View more
- Tags:
- search-language
