I have a field in my Apache logs that's defined as "MicroSeconds". This is the response time in microseconds for a specific call in Apache to our Weblogic back ends.
I'm trying to generate a real time chart on the average response times based on the "Microseconds" field. I'd like to be able to convert microseconds to milliseconds so I don't freak out our users when they see a transaction hit 4000..
How would I do that? The basic search right now is:
index="uat_apache_logs" /pbng | timechart avg(MicroSeconds)
which works good..I just need to convert it to milliseconds..
Thanks in advance.
You can use the "eval" command to perform operations in field values: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval
In your case:
... | timechart avg(MicroSeconds) as avgus | eval avg_milliseconds = avgus/1000
How did you define the field in Splunk? I assume you are using the Apache response time option in the log format?
Thanks
Ed
You can use the "eval" command to perform operations in field values: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval
In your case:
... | timechart avg(MicroSeconds) as avgus | eval avg_milliseconds = avgus/1000
Answer is disarmingly simple - just do the eval before the timechart instead of after. "eval milliseconds=MicroSeconds*1000 | timechart avg(milliseconds)"
That works. Anyway to make drilldown work with this? I get a "# PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command"
Brian