About KangKangZhu

KangKangZhu · ‎05-28-2010

Hi gkanapathy, I just counted the requests by using grep from the log file directly, seems you are right the first expression wasn't give the right answer here, so i have two questions for you: a).why the first one is wrong, i'm stupid and i use it was because i saw an example from the document "Return the average "thruput" of each "host" for each 5 minute time span. ... | bucket _time span=5m | stats avg(thruput) by _time host" so i think use it can put all events into discrete sets by using 1sec as time range, and then doing count for each set should get the right answer. ( i knew i didn't consider the ReqTime for calculating concurrency, however in my opinion, the result should match with the "grep") b). If the second one is right, how can i set the range to 1 sec instead of 10 minutes _time max(concurrency) 1 5/16/10 5:**50**:00.000 PM 111 2 5/16/10 5:**40**:00.000 PM 141 and what's the unit of "duration"? the unit of ReqTime is msec in our system. thanks Jason

KangKangZhu · ‎05-27-2010

Hi Guys, Thanks for your quick responses! I just got a chance to try "concurrency" in my local, however the result wasn't make sense to me, the case i was using for testing is "Showing the max concurrency count in second level of day '05/16/2010'" and i tried to use two expression to figure it out: index=main Type=API earliest=05/16/2010:6:0:0 latest=05/16/2010:18:0:0 | bucket _time span=1s | stats count(_raw) by _time | sort -count(_raw) | head 1 _time count(_raw) 1 5/16/10 5:35:36.000 PM 28 index=main Type=API earliest=05/16/2010:6:0:0 latest=05/16/2010:18:0:0 | concurrency duration=ReqTime | timechart max(concurrency) _time max(concurrency) 1 5/16/10 6:00:00.000 AM 47 ... the result was different, i'm not sure which one is right, do you think the expression i used is make sense? Thanks Jason

KangKangZhu · ‎05-19-2010

Hello, We are using Splunk to monitor the traffic of our system, and i was asked to give a report for showing the moving maximum concurrency count in second level of the recent 30 days, for example: day-1 **_time=5/9/10 12:00:01,Type=UI, ReqTime=100 _time=5/9/10 12:00:01,Type=UI, ReqTime=1 _time=5/9/10 12:00:01,Type=UI, ReqTime=30 _time=5/9/10 12:00:01,Type=UI, ReqTime=9** _time=5/9/10 12:00:02,Type=UI, ReqTime=5 There are 4 concurrency requests at "5/9/10 12:00:01" day-2 _time=5/10/10 1:00:01,Type=UI, ReqTime=3 _time=5/10/10 1:00:01,Type=UI, ReqTime=2 _time=5/10/10 1:00:01,Type=UI, ReqTime=50 _time=5/10/10 12:00:01,Type=UI, ReqTime=0 _time=5/10/10 12:00:02,Type=UI, ReqTime=1 There are 3 concurrency requests at "5/10/10 1:00:01" ... day -30 I want to have chart like this: Day Max concurrency count per second Time 5/9/2010 4 5/9/10 12:00:01 5/10/2010 3 5/10/10 1:00:01 ... thanks in advance! Jason

Posts	3
Solutions	0
Karma Given	0
Karma Received	3
Member Since	‎05-19-2010

Online Status	Offline
Date Last Visited	‎06-05-2020 02:02 AM

how to show a moving average in the recent 30days ...

Re: how to show a moving average in the recent 30d...

Re: how to show a moving average in the recent 30d...

how to show a moving average in the recent 30days ...