Splunk Search

Retrieve slow queries in splunk search

pgadge
New Member

Hi Guys,

I am very new to splunk and operating on thew following data. I want to retrieve SQL queries which take more than 4 secs. My data looks like this,

Time: 130114 18:25:24

User@Host: web-03-prod-01[web-03-prod-01] @ [10.2.2.88]

Query_time: 4.137378 Lock_time: 0.000114 Rows_sent: 248 Rows_examined: 1777155

How can I use > or < operator to retrieve data which has a Query_time value more than 4 secs.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

First make sure you have the query time extracted as a field. See the following section in the docs: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime

Then you can just do

query_time>4

in your search.

View solution in original post

0 Karma

Ayn
Legend

First make sure you have the query time extracted as a field. See the following section in the docs: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime

Then you can just do

query_time>4

in your search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...