This article explains a way to create a search that shows the Events Per Second per Log Source in JSA. 

By default, JSA has a quick search for Top 10 Log Sources. There is no automated method to perform an Events Per Second search per Log Source in JSA. However you can create a new search by following the steps:

1. From the JSA Web User Interface go to the Log Activity tab.
2. Select Search > New Search.
3. In the new page scroll down to Column Definition.
4. Select Log Source in the list of Columns and click the < button to send it back to the main list.
5. Select the Log Source in the list of available columns and click the > button to allow you to add it to Group By.
6. The default entries in the Columns will now change.

You can inspect the search when it completes to investigate the top Log Sources with the most number of events and even save the Search Criteria for later use.

This search will show you the total events coming in JSA based on the time range selected. You will need to do some additional Math to allow you obtain the event rate per second. For example, with a 5 minute search, divide the total events count by 300 to get the average Events Per Second for a particular log source.

Alternatively you can do an Advanced Search using AQL to accomplish the same results.

SELECT LOGSOURCENAME(logsourceid) AS "Log Source", SUM(eventcount) AS "Number of Events in Interval", SUM(eventcount) / 300 AS "EPS in Interval" FROM events GROUP BY "Log Source" ORDER BY "EPS in Interval" DESC LAST 5 MINUTES

Where `300` should be equivalent to the number of seconds in the interval, in this case `LAST 5 MINUTES`.

Results: You can now view the EPS of the Top 10 Log Sources.




 

14/2/2024: KB created

24/11/205: Minor edits and changed visibility