Splunk Search

Calculate max Transaction per second per day

tmurray3
Path Finder

I am trying to figure out how to calculate the highest number of transaction per second for a given day. I would like the output to print the time and count. For example, at 10/11/2013 12:30:33 pm, 45 TPS

I cannot seem to figure out the query.

Thanks in advance for your help.

Tags (3)
0 Karma

the_wolverine
Champion

Use tstats if possible for performance:

| tstats count where index=APPAUTH earliest=-1w by _time span=1s | timechart span=1d max(count)
0 Karma

kristian_kolb
Ultra Champion

You can shorten the calculation a bit to;

index=appauth AUTH earliest=-1w | bucket _time span=1s | top 1 _time by date_mday | fields - percent, date_mday

Just change the earliest value as needed.

/K

0 Karma

tmurray3
Path Finder

I figured out how to calculate the max tps for a given day using the following query

index=appauth AUTH earliest=-1d|bucket _time span=1s|stats count by _time|sort by count,time DESC limit=1

However, I would also like to display the max tps per day over a week.

Any ideas?

0 Karma

manidandu
Explorer

Hi,

Do you have any resolution for this? Please post if you have any sample query.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...