Splunk Search

timechart per_second working.

deepak02
Path Finder

Hi,

I found a query I could not understand:
| eval foo=1 | timechart per_second(foo) as "Bytes per second"

Why set foo to 1 and then pass it in?

Ref: https://answers.splunk.com/answers/10147/how-to-show-events-per-second-in-timechart-regardless-of-sp...

Can anyone pls explain?

Thanks,
Deepak

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

The main thing to understand is that there is a search before that far left pipe symbol, that is selecting some number of records, each of which has a _time field representing when it was indexed.

Therefore, the timechart command is receiving a set of records that have _time and foo=1. timechart is calculating the sum of the foo values per second, and displaying them on a whatever basis it thinks is best. For short time periods, it will be second-by-second, amounting to the sum of the foos.

Thus, in that case, that code snippet is the equivalent of the much simpler...

your search | timechart count as "Bytes per second" 

Across a longer time range, it will calculate the AVERAGE SUM of the foos per second across each chunk of time span that timechart chooses to display.

It can be forced to make more sense, however, if you manually set the span value and name the field correctly ...

your search | eval foo=1 | timechart span=5m per_second(foo) as "Transactions per second" 
0 Karma

somesoni2
SplunkTrust
SplunkTrust

That query provides number of events with per_second aggregation. You create a field foo with value 1, so that each event will have that field and you can calculate per_second count of events on this numerical data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...