Reporting

Generating response time report

DFresh4130
Path Finder

We have a search application with not so friendly formatted logging for reporting on. I'm having trouble extracting the response times from lines like below and then generating a response time report of some kind. Any suggestions?

2014-03-25 12:00:10,827 INFO [com.search.web.common.filter.PerformanceFilter] - /global/search.action,364ms query=ABC

Below is what I've come up with so far, but am stuck on how to accurately put the data into a report of some kind.

sourcetype="sfe" search.action | regex_raw="\d{2,5}ms"
Tags (1)
0 Karma

dkuk
Path Finder

It'd probably be worth auto-extracting the response time into a field so that whenever you search for sourcetype "sfe" you have a field that represents response time.

Then you'll have a field that you can perform statistical commands on, such as max, min, avg etc.

With that in mind I'd create props.conf entry to hook into sourcetype sfe. Something like the below:

props.conf:

[sfe]
EXTRACT_sfe_resp_time = ,(?<resp_time>\d{1,6})ms

Then you could run your search through a timechart command something like this:

sourcetype=sfe search.action | timechart avg(resp_time) by host

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...