Splunk Search

Calculate max Transaction per second per day

tmurray3
Path Finder

I am trying to figure out how to calculate the highest number of transaction per second for a given day. I would like the output to print the time and count. For example, at 10/11/2013 12:30:33 pm, 45 TPS

I cannot seem to figure out the query.

Thanks in advance for your help.

Tags (3)
0 Karma

the_wolverine
Champion

Use tstats if possible for performance:

| tstats count where index=APPAUTH earliest=-1w by _time span=1s | timechart span=1d max(count)
0 Karma

kristian_kolb
Ultra Champion

You can shorten the calculation a bit to;

index=appauth AUTH earliest=-1w | bucket _time span=1s | top 1 _time by date_mday | fields - percent, date_mday

Just change the earliest value as needed.

/K

0 Karma

tmurray3
Path Finder

I figured out how to calculate the max tps for a given day using the following query

index=appauth AUTH earliest=-1d|bucket _time span=1s|stats count by _time|sort by count,time DESC limit=1

However, I would also like to display the max tps per day over a week.

Any ideas?

0 Karma

manidandu
Explorer

Hi,

Do you have any resolution for this? Please post if you have any sample query.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...