Monitoring Splunk

decompose response time

fcarre
New Member

I am tracking reponse time in n-tiers applications.

Let's assume that we have a client request log and a database request log. Each client request has a unique transaction_ID in the client log. The database log records 3 different requests for a single client request and specifies the transaction_ID corresponding to the client request served by the database requests.

I would like to correlate the client and database log so that I can decompose the client request time in "application time" and "database time" (sum of the 3 database request response time).

Also, I would like to drill down on the database time to see the 3 different requests.

What do you recommend ?

0 Karma

sdaniels
Splunk Employee
Splunk Employee

The transaction command may be the right approach in this case. Take a look at this previous answer which is very detailed.

http://splunk-base.splunk.com/answers/29172/transaction-problems-with-lots-of-events-and-multiple-fi...

From the docs (there are example transactions):
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction

The Transaction profiling app might be interesting for you to look at as well.

http://splunk-base.splunk.com/apps/29011/splunk-app-for-transaction-profiling-preview

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...