Hello everyone.
Want to display the output only for the time which crosses 18 months (earliest time)
In your stats command you can add Req in by clause, if that is what you want as output . See below-
stats avg(RequestsPerSec) as AvgRequestsPerSec , max(RequestsPerSec) as MaxRequestsPerSec , p95(RequestsPerSec) as P95RequestsPerSec by Req host_type _time
You can use bin and stats instead of timechart-
host=pcde* sourcetype=qwedc
| eval host_type=case(host LIKE "%raf%", "RAF", host LIKE "%tap%", "TAP", host LIKE "%dft%", "DFT"
| streamstats count as Req by host_type
| eval RequestsPerMin=Req/24/60
| eval RequestsPerSec=RequestsPerMin/60
|bin span=5m _time| stats avg(RequestsPerSec) as AvgRequestsPerSec , max(RequestsPerSec) as MaxRequestsPerSec , p95(RequestsPerSec) as P95RequestsPerSec by host_type _time
|eval AvgRequestsPerSec=round(AvgRequestsPerSec,2), MaxRequestsPerSec=round(MaxRequestsPerSec,2), P95RequestsPerSec=round(P95RequestsPerSec,2)
|sort -MaxRequestsPerSec, -P95RequestsPerSec