We are using Splunk to monitor the traffic of our system, and i was asked to give a report for showing the moving maximum concurrency count in second level of the recent 30 days, for example:
There are 4 concurrency requests at "5/9/10 12:00:01"
There are 3 concurrency requests at "5/10/10 1:00:01"
... day -30
I want to have chart like this:
thanks in advance!
Indeed this is exactly the sort of use case that the concurrency command was added for:
Concurrency is only in 4.1. If you havent upgraded to 4.1 yet, it's possible there was a difficult and somewhat evil way of achieving the same thing with other search language and without
answered 19 May '10, 17:10
Seems to me you can use the
answered 19 May '10, 09:26
Thanks for your quick responses!
I just got a chance to try "concurrency" in my local, however the result wasn't make sense to me, the case i was using for testing is
"Showing the max concurrency count in second level of day '05/16/2010'"
and i tried to use two expression to figure it out:
the result was different, i'm not sure which one is right, do you think the expression i used is make sense?
answered 27 May '10, 10:16
I just counted the requests by using grep from the log file directly, seems you are right the first expression wasn't give the right answer here, so i have two questions for you:
a).why the first one is wrong, i'm stupid and i use it was because i saw an example from the document
so i think use it can put all events into discrete sets by using 1sec as time range, and then doing count for each set should get the right answer. ( i knew i didn't consider the ReqTime for calculating concurrency, however in my opinion, the result should match with the "grep")
b). If the second one is right, how can i set the range to 1 sec instead of 10 minutes
and what's the unit of "duration"? the unit of ReqTime is msec in our system.
answered 28 May '10, 02:55
This is a very interesting question and none of the answers actually get you to the full solution, where you find not only the top concurrency during the day, but when that occurred.
First you should note that the
Here's the first search, which will find the most recent occurrence of the top concurrency time of the day:
Now your actual search is a bit trickier since we may have many points in the day of highest concurrency:
The general recipe here is:
Note that this technique can be used on splunk_access.log data using the following search:
answered 20 Aug '10, 19:13
Stephen Sorkin ♦