One limitation of the concurrency command is that there is no way to simultaneously calculate the concurrency for multiple sets of data. For instance, what if you wanted to know the concurrency per host, as opposed to concurrency across your entire environment?
In our sample set of data, we have only one host, but we have multiple values for the network field. Let's use that field for our exercise.
Our fake concurrency example from the previous section looks like this:
sourcetype=impl_splunk_gen network="*" | eval d=2 | concurrency duration=d | timechart max(concurrency)
First, let's rebuild this search using the streamstats command. This command will calculate the rolling statistics and attach the ...
