Security

stats after per_second function

deepak02
Path Finder

Hi,

I have a search query that looks like this,

<filter conditions> 
| eval count=1 
| timechart per_second(count) as TPS 
| eval TransactionPerSecond=max(TPS)  
| stats max(TransactionPerSecond) by source, sourcetype, fieldA, fieldB

What I am trying to do is split the 'Transactions per Second' value by source, sourcetype, fieldA and fieldB.

The stats part of it is not giving me any results.

Are there any other ways to implement the above logic?

Thanks,
Deepak

Tags (1)
0 Karma

woodcock
Esteemed Legend

Do it like this:

index=_*
| eval count=1, fieldA=host, fieldB=date_hour

| rename COMMENT AS "Everything above generates sample data (do for 'Last 200 seconds'); everything below is your solution"

| eval multi_key = source . "::" . sourcetype . "::" . fieldA . "::" . fieldB
| timechart span=1s per_second(count) BY multi_key
| untable _time multi_key TPS
| rex field=multi_key "^(?<source>.*?)::(?<sourcetype>.*?)::(?<fieldA>.*?)::(?<fieldB>.*)$"
| stats max(TPS) BY source sourcetype fieldA fieldB

micahkemp
Champion

I think this would give you max transactions per second:

<base search> 
| bin span=1s _time
| stats count as TPS by source, sourcetype, fieldA, fieldB, _time
| stats max(TPS) by source, sourcetype, fieldA, fieldB
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...