how to get Transactions per second based on average values for each instance

[jkalra]

How to get Transactions per second from the following table(table 1). I also have a table which gets me the per second transactions and avg. How can I use the table with average values (table 2)
The following search gives me the Table 1
index=cams component=uas sourcetype="forgerock:auth" o=sco | where message_desc = "Authentication Failed"| chart count over instance by message_desc | rename "Authentication Failed" as "Number of transactions"

Table 1:

Following is the table 2 which I have which has the average of field values for each transaction type(Authentication failed) by instance viz., 11,12,21,22

[woodcock]

If you are using All-time the other answer won't work so try this one:

index=cams component=uas sourcetype="forgerock:auth" o=sco message_desc = "Authentication Failed"
| chart count min(_time) AS info_min_time max(_time) AS info_max_time BY Instance
| eval TransactionsPerSecond = count/(info_max_time - info_min_time)
| rename count AS "Number of transactions"
| fields - info_*

[jkalra]

Gregg...sorry ..my bad..... i guess the "BY" command had to be a lower case...I changed that and it worked.

[jkalra]

Gregg....I see no difference in the output...I still get just the Instance and Number of Transactions. no luck with the TPS.
Also, I was able to get the Avg number of transactions per second/instance. How do I get the TPS over any time range?

[woodcock]

The eventstats was in the wrong place. I edited my answer (and made your stuff more efficient). Try it again.

[jkalra]

Thanks Gregg...Unfortunately I get "No results" for any time range I select

[woodcock · Accepted solution]

Like this:

index=cams component=uas sourcetype="forgerock:auth" o=sco | where message_desc = "Authentication Failed"| chart count over instance by message_desc | rename "Authentication Failed" as "Number of transactions" | addinfo | eval TransactionsPerSecond = $Number of transactions$/(info_max_time - info_min_time) | fields - info_*

[jkalra]

Thanks Gregg...
not sure what I should be using duration for.? it gives me an error at "duration"

[woodcock]

Sorry, that was a typo. I have fixed it in the original answer; try it again.

[jkalra]

Ok...thanks ...but I get info- max time as Infinity and info min time -0.00

[somesoni2]

Your requirement is unclear. What exactly you're trying to do? Could you share your expect result/format?

[jkalra]

All I am trying to do is get a TPS(transactions per second) for the following table ( link below). I already have the "NUmber of transactions per instance namely 11, 12, 21, 21 and I am looking to get the TPS for 11,12,21,22 over any time range.

I managed to get a table ( second table) which averages the Transactions by instance, but how do i get the TPS out of this. I would prefer to use the first table and get the TPS or the second table can also be used to derive TPS out of the average for each instance

https://answers.splunk.com/storage/temp/134206-1.png