Hi,
Maybe this query can Point you in the right direction! It's not using the per_second from timechart, but should hopefully get the output you are looking for:
<SEARCH>
| bin _time span=1d
| streamstats count as Req by OrgName
| eval requestsPerMin=Req/24/60
| eval requestsPerSec=requestsPerMin/60
| stats avg(requestsPerMin) as avgRequestPerSec, max(requestsPerMin) as peakRequestPerMin by OrgName
If you want to see see the result/day, add the _time to to streamstats and stats to split it per day:
<SEARCH>
| bin _time span=1d
| streamstats count as Req by OrgName, _time
| eval requestsPerMin=Req/24/60
| eval requestsPerSec=requestsPerMin/60
| stats avg(requestsPerMin) as avgRequestPerSec, max(requestsPerMin) as peakRequestPerMin by OrgName, _time
... View more