Splunk Search

Throughput calculation over last "n" number of days

snabi
Explorer

I have following query which calculates and charts(hourly) file conversion throughput over last 24 hours however i am not able to range that over "n" number of days.... an attempt to configure that with (-7d to now)...... it charts throughput of each hours ( it seems this query adds up target hour from all seven days) showing only 24 spikes covering all 7 days ( i assume)

What am i doing wrong?

sourcetype="sourceA" "Conversion completed" AND source="/home/services.log" | rex field=_raw "Original file size: (?<Original_size>.\d+)" | rex field=_raw "Time spent: (?<time_spent>.\d+)" | stats sum(Original_size) as size1 sum(time_spent) as time1 by date_hour | eval time1=(time1)/1000 | eval conversion_rate=size1/(time1*1024*1024) | chart sum(conversion_rate) as "(MBytes_per_sec)" by date_hour
Tags (3)
0 Karma
1 Solution

snabi
Explorer

sourcetype="X" "Conversion completed" AND source="X.log" | rex field=_raw "Original file size: (?.\d+)" | rex field=_raw "Time spent: (?.\d+)" | stats sum(Original_size) as size1 sum(time_spent) as time1 by date_hour | eval time1=(time1)/1000 | eval conversion_rate=size1/(time1*1024*1024) | chart sum(conversion_rate) as "(MBytes_per_sec)" by date_hour

this one worked for me...
Thanks for all the supports...

View solution in original post

0 Karma

snabi
Explorer

sourcetype="X" "Conversion completed" AND source="X.log" | rex field=_raw "Original file size: (?.\d+)" | rex field=_raw "Time spent: (?.\d+)" | stats sum(Original_size) as size1 sum(time_spent) as time1 by date_hour | eval time1=(time1)/1000 | eval conversion_rate=size1/(time1*1024*1024) | chart sum(conversion_rate) as "(MBytes_per_sec)" by date_hour

this one worked for me...
Thanks for all the supports...

0 Karma

grijhwani
Motivator

Here is a search I constructed to perform something similar (specifically, comparing licence usage per hour over the last N days):

index="_internal" source="*license_usage.log" | eval ISODate=strftime(strptime(date_year."-".date_month."-".date_mday, "%Y-%b-%d"), "%Y-%m-%d (%a)") | eval MB=b/1024/1024 | chart eval(round(sum(MB),0)) over date_hour by ISODate limit=0  | addcoltotals labelfield=date_hour

The reconstruction of the date is a little kludgy and could probably be improved dramatically using convert, but I threw this together in my early Splunking days.

0 Karma

kristian_kolb
Ultra Champion

There are only 24 possible values for date_hour, so spanning over more than 24 hours will automatically group statistics from different days into the same bin, so to speak. Perhaps you could replace your stats command with timechart span=1h sum(Original_Size) as size1 sum(time_spent) as time1?

That will get you n x 24 slots for your statistics.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...