Splunk Search

subquery to get average throughput

rakesh_498115
Motivator

Hi ,

I need to find the average throughput of the sales transaction.ie no of requests /no of responses * 100 .. so i have used the subsearch like this ..but couldnt get the results..

soucetype="X" POST [ soucetype="X" GET | stats count as TotalReq ] | stats count as TotalRes | eval Throughput=(TotalReq*100)/TotalRes | table Throughput

But this didnt work..need help on this..

Tags (1)
0 Karma

sideview
SplunkTrust
SplunkTrust

the approach you're intuitively looking for is more like the 'appendcols' param.

What your current subsearch will do, in a literal sense, is add the following search term to the 'outer' search: TotalReq="117", which is not going to be useful.

However, what you want to do instead of using any kind of square bracket syntax, is extract the values GET and POST from the raw events (they may already be extracted as a field called 'method', and then things get much easier.

For example, this will automatically give you a percent column:

sourcetype="X" | top method

but if you want to generate things more manually, you can still do things like this:

sourcetype="X" | eventstats count as totalCount | stats first(totalCount) as totalCount count by method | eval throughput=count*100/totalCount

The eventstats and streamstats commands are both useful for places where you feel like you need to process the data twice, places where often people reach out to subsearches and append/join initially.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...