Splunk Search

How to calculate response time from logs?

ajaynaralikar
New Member

I want to calculate response time from my logs for all records and our application logs in below format,

19-02-2018 23:02:04:371 [RetrieveCompanyData][INFO ]: |BEM_Gateway_Request_MF Request Processing Summary(TransactionId-GCP_708425245) SCVT Recieved Request at 19-02-2018 23:02:04:367
19-02-2018 23:02:15:017 [RetrieveCompanyData][INFO ]: |BEM_Gateway_Response_MF Request Processing Summary(TransactionId-GCP_708425245) SCVT sent response back to consumer at 19-02-2018 23:02:15:015
so can you provide query to for this

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this. You can remove those rex statements if the fields are already extracted.

your base search for selecting only the request and response events
| rex "Recieved Request at (?<request>\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3})"
| rex "sent response back to consumer at (?<response>\d{2}-\d{2}-\d{4} \d{2}:\d{2}:\d{2}\.\d{3})"
| rex "TransactionId-(?<transactionId>[^\)]+)"
| stats values(request) as request values(response) as response by transactionId
| convert mktime(request) mktime(response) timeformat="%d-%m-%Y %H:%M:%S.%3N" 
| eval responseTime=response-request
0 Karma

ajaynaralikar
New Member

I tried and I got result in below format. But I want one more column which will show (response-request) result

transactionId   request                     response

1 GCP_198253791 21-02-2018 08:13:32:045 21-02-2018 08:13:35:049
2 GCP_218300826 21-02-2018 08:22:25:047 21-02-2018 08:22:29:177
3 GCP_221454910 21-02-2018 08:06:52:611 21-02-2018 08:06:53:412

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

The eval at the end gives you the responseTime field that has that information, should just be there if you're not filtering fields after the eval, sounds like you might be filtering it out somewhere though?

Add this to the end for a bit of formatting/filtering:
| table transactionId responseTime request response

0 Karma

ajaynaralikar
New Member

I tried and got below result.
transactionId request response
1 GCP_198253791 21-02-2018 08:13:32:045 21-02-2018 08:13:35:049
2 GCP_218300826 21-02-2018 08:22:25:047 21-02-2018 08:22:29:177
3 GCP_221454910 21-02-2018 08:06:52:611 21-02-2018 08:06:53:412

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...