Splunk Search

How to convert a cumulative total into a rate

adriangrassi
Explorer

I have this field which display the total number of transactions since the server has been started. I need to find out our transaction rate and I can't seem to do this in Splunk.
Our stats gets collected every 5 minutes and look something like this:

01:10am Messages=1000
01:15am Messages=1500
01:20am Messages=2000
etc..
That means that between 1:10 and 1:15 the server processed 500 transactions and that's the result I need to get from Splunk so that I can calculate our transactions per second rate.

As far as I can tell Splunk would need to know the previous 5 minute value and compare to the current value of the field.

I tried this but it doesn't work as I get the accumulated total:
| stats sum(eval(Msgs/300)) as Trans by host

Thanks for any help.

Tags (2)
0 Karma
1 Solution

adriangrassi
Explorer

I was able to finally get this working using the following query:

search | bucket _time span=5m | stats sum(eval(Msgs)) as 5MinCount by host _time | delta 5MinCount | sort _time | stats latest by host | rename latest(delta(5MinCount)) as delta | stats sum(eval(delta/300)) as Transactions_per_sec by host

This query above takes 2 samples of a cumulative total and finds the difference between them and then calculates the rate while ignoring the 1st set of delta data which is invalid since it has nothing to compare against.

Hopefully this helps someone else in the same situation.
For the record I still think that converting a cumulative total into a transaction rate should have been its own function in Splunk.

Thanks,
-Adrian

View solution in original post

0 Karma

adriangrassi
Explorer

I was able to finally get this working using the following query:

search | bucket _time span=5m | stats sum(eval(Msgs)) as 5MinCount by host _time | delta 5MinCount | sort _time | stats latest by host | rename latest(delta(5MinCount)) as delta | stats sum(eval(delta/300)) as Transactions_per_sec by host

This query above takes 2 samples of a cumulative total and finds the difference between them and then calculates the rate while ignoring the 1st set of delta data which is invalid since it has nothing to compare against.

Hopefully this helps someone else in the same situation.
For the record I still think that converting a cumulative total into a transaction rate should have been its own function in Splunk.

Thanks,
-Adrian

0 Karma

kristian_kolb
Ultra Champion

...| table _time Messages | delta Messages as Current | eval TransRate = Curr / 300

/k

0 Karma
Get Updates on the Splunk Community!

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...