Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

How to chart maximum simultaneous (per second) events over larger time ranges

$
0
0

My data source resolution is seconds, so I can sonsider "simultaneous" events that are logged with the same second timestamp. Thus each second I would have a number of events.

I want to generate a chart, where each bar would represent the biggest number of events that were logged during one second over the period represented by the bar. Not a sum, not an average and not an average over time. Ex: if each bar represents 4 seconds, and one bar has a count of 100 events with the following per-second event counts: (4,36,60,0), the bar should be 60 high.

I would be looking for something I could describe like

 ... | timechart max(per_second(count))

but that does not work at all (even if I put count in a variable).

... | timechart span=1s count

Sort of works for small timespans, but would fail for spans that need to scale and will hit result limits for larger timespans.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>