Splunk Search

subtract response time value in 'ms' from the _time field and assign it to new field.

nmohammed
Contributor

Hi,

Our application logs an event at the end of completion of an api call with response time in milliseconds(ms) like this <16ms>. I have already extracted the response time into field "ex_time" . we need to find the start time of the api call and assign it to a field possibly... where the start time is difference between log event timestamp (_time) and response time (ex_time). how can we achieve this ?

start_time = _time - ex_time

The start time should be in same format as the _time field.

Sample event --

[02/28/17 10:24:12.5387] DEBUG {14679}: <6189c8b7-59f9-4c63-bb91-6b1eb4435706>MilestonesAclManager.CheckPermissions(, "2") by dren.lock/Elapssecom/b7b05b47-c853-4dcd-9dd0-3dfab3c2cf77. ,<16ms>

Any hints and help appreciated.
Thanks

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

The _time is a special field whose underlying values is in epoch format. Give this a try

your base search | eval start_time=_time-(ex_time/1000) | convert ctime(start_time) 

You can also specify your own format like this

your base search | eval start_time=_time-round(ex_time/1000,4) | convert ctime(start_time) timeformat="%m/%d/%y %H:%M:%S.%4N")

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

When sending a post including code, be sure to mark it as code with the button that say 101 010. That will keep the interface from treating pieces of it as html and format instructions.

What part of your sample event is the elapsed ms?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The _time is a special field whose underlying values is in epoch format. Give this a try

your base search | eval start_time=_time-(ex_time/1000) | convert ctime(start_time) 

You can also specify your own format like this

your base search | eval start_time=_time-round(ex_time/1000,4) | convert ctime(start_time) timeformat="%m/%d/%y %H:%M:%S.%4N")

nmohammed
Contributor

Thanks SomeSoni. the second one worked as expected.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...