Splunk Search

How to calcuate the average response time in seconds for a field?

rajeshmeea21
Explorer

I am trying to calculate the average response time in seconds for one of my fields.
Getting exception in result set.. Highlighted with value 1:16.000 and 1:46.675
While calculating the average (avg) response time, i am not able to get these converted to seconds.

Is there any workaround where i can calculate avg response time correctly? This field is a number.

Below image will give you clearer idea.

alt text

0 Karma
1 Solution

gokadroid
Motivator

If the current response times are in field called response_time then can you please try to see if this works for you:

your query to return events
| rex field=response_time "^(?<myMinutes>[^\:]+)\:(?<mySeconds>.*)"
| eval myResponseTime=(myMinutes*60)+mySeconds
| eval response_time=coalesce(myResponseTime, response_time)
| stats avg(response_time) as AvgRespTimeInSec

View solution in original post

woodcock
Esteemed Legend

If I understand you correctly, like this:

... | rex field=response_time "^(?<remainder>.*?)(?<seconds>[^:\s]+)$" 
| rex field=remainder "^(?<remainder>.*?)(?<minutes>[^:\s]+):$" 
| rex field=remainder "^(?<days>.*?)(?<hours>[^:\s]+):$" 
| rex field=days mode=sed "s/://" 
| fillnull value="0" days hours minutes seconds 
| eval days=if(len(days)=0, 0, days) | rename COMMENT AS "<-Bug fix for values like 2:3:4" 
| fields - remainder 
| eval response_time_seconds_only = seconds + 60 * (minutes + 60 * (hours + 24 * days))
0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi rajeshmeea21,

I don't know how you calculated the response time field, but your log sample doesn't look right with the two exceptions.
Assuming that you calculated your response duration by subtracting time of response and time of post, the duration should be converted into a time format:

duration=tostring(post_time - response_time,"duration")

Hope this helps. Thanks!
Hunter

0 Karma

gokadroid
Motivator

If the current response times are in field called response_time then can you please try to see if this works for you:

your query to return events
| rex field=response_time "^(?<myMinutes>[^\:]+)\:(?<mySeconds>.*)"
| eval myResponseTime=(myMinutes*60)+mySeconds
| eval response_time=coalesce(myResponseTime, response_time)
| stats avg(response_time) as AvgRespTimeInSec

woodcock
Esteemed Legend

My solution is very similar but is extended for longer periods of time.

0 Karma

rajeshmeea21
Explorer

Here is a sample log..

01/06 11:23:52.792 - 18.208 - 10.10.20.100:25640 - 8080 - "POST / HTTP/1.1" - 200 OK - 2336365 - 
01/06 11:23:26.549 - 1:16.000 - 10.10.20.100:25640 - 8080 - "POST / HTTP/1.1" - 200 OK - 987 - 
01/06 11:23:26.215 - 1:46.675 - 10.10.20.100:25640 - 8080 - "POST / HTTP/1.1" - 200 OK - 1650 - 
01/06 11:23:26.215 - 27.817 - 10.10.20.100:25640 - 8080 - "POST / HTTP/1.1" - 200 OK - 1650 -

I am capturing full value in response_time field.

0 Karma

jagadeeshm
Contributor

Posting a sample event will help.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@rajeshmeea21 - It would be helpful if you were to provide your current search. The more information and context you can provide in your question, the better chance users in the Answers community can help provide you with a working solution.

0 Karma

rajeshmeea21
Explorer

Sample logs:

01/06 11:23:52.792 - 18.208 - 10.10.20.100:25640 - 8080 - "POST / HTTP/1.1" - 200 OK - 2336365 - 
01/06 11:23:26.549 - 1:16.000 - 10.10.20.100:25640 - 8080 - "POST / HTTP/1.1" - 200 OK - 987 - 
01/06 11:23:26.215 - 1:46.675 - 10.10.20.100:25640 - 8080 - "POST / HTTP/1.1" - 200 OK - 1650 - 
01/06 11:23:26.215 - 27.817 - 10.10.20.100:25640 - 8080 - "POST / HTTP/1.1" - 200 OK - 1650 -

Search query:-

index=test | stats avg(response_time) by Module_Name
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...