Splunk Search

Need to find the Top transaction's response ti,e

RashmiGowda
Explorer

I need to find the response time for most occuring / most frequest Transaction

So M trying the following query:

index="abc" source="xyz.log" | timechart max(TransRespTime) by TransName | top 5 TransName.

but this query is not showing the result as expected.

I need to display the result in the form of chart / graph.

Anyone can please suggest me the solution.

Thanks in advance..!!

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Without knowing your data I'm guessing you're looking for something like this:

index="abc" source="xyz.log" [search index="abc" source="xyz.log" | top 5 TransName | fields TransName] | timechart max(TransRespTime) by TransName

Or this:

index="abc" source="xyz.log" | timechart limit=5 useother=f max(TransRespTime) by TransName

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Without knowing your data I'm guessing you're looking for something like this:

index="abc" source="xyz.log" [search index="abc" source="xyz.log" | top 5 TransName | fields TransName] | timechart max(TransRespTime) by TransName

Or this:

index="abc" source="xyz.log" | timechart limit=5 useother=f max(TransRespTime) by TransName
0 Karma

RashmiGowda
Explorer

Sorry.. Its working.. I just missed to add sub search thing.. @martin_muller

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The search looks correct to me... beyond that, I can't magically look into your system, data, or Splunk logs. You'll have to provide some relevant info to find any issue.

0 Karma

RashmiGowda
Explorer

@martin_muller, The first query suggested is not displaying the results.. 😞 could u ple suggest

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...