Splunk Enterprise

How to calculate in customized query the response time from the logs below?

Ash1
Communicator

Hi All.
I am trying to calculate the response time from the logs below.

11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=100sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=10sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=50sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=40sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=130sec

 

 

 

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx  by PREFIX(completetime=)
|rename completetime= as Time
|timechart span=1d avg(Time) by host
|eval ResTime =round(,Time2)

 




When i am trying to run this query i am not bale to calculate the average of time because when i am doing PREFIX(completetime=) here sec word is also taking up.
How can i ignore it.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the tonumber() function to extract only the digits from the Time field.

 

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx  by PREFIX(CompleteTime=)
|rename CompleteTime as Time
|eval Time=tonumber(Time)
|timechart span=1d avg(Time) as ResTime by host
|eval ResTime =round(ResTime, 2)

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Ash1
Communicator

@richgalloway ,
when i tried to give tonumber i am still seeing Sec
|evak Time=tonumber(Time)

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

In that case, try this alternative that uses rex to extract only the digits from Time.

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx  by PREFIX(CompleteTime=)
|rename CompleteTime as Time
|rex field=Time "(?<Time>\d+)"
|timechart span=1d avg(Time) as ResTime by host
|eval ResTime =round(ResTime, 2)

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...