topic How to plot response time against _time field in Splunk Enterprise

How to plot response time against _time field

shashank_24 — Wed, 15 Jul 2020 09:43:12 GMT

Hi, I am trying to plot the response time values against _time field. I am aware of the timechart and stats command which i can use to calculate the average or percentile but what i would want is to plot the actual values over time.

I have the below query where I want field responseTime on y-axis vs _time on x-axis with actual values and not the average. Is that possible to do without using transforming commands?

index=test host="serverer-p*" RESPONSE "uri=[/checkout/my-app]" | rex field=_raw"\[(?<responseTime>[^\s]+)"

Re: How to plot response time against _time field

renjith_nair — Wed, 15 Jul 2020 10:29:24 GMT

What happens if you just add

|table _time,responseTime and select a visualization

Re: How to plot response time against _time field

shashank_24 — Wed, 15 Jul 2020 11:29:11 GMT

@renjith_nair You would say I was stupid. I was actually trying that but instead of table I was using fields command. With table command it works. Thank you.

index=test host="serverer-p*" RESPONSE "uri=[/checkout/my-app]" | rex field=elapsedTime "\[(?<responseTime>[^\s]+)" | table _time responseTime

Re: How to plot response time against _time field

renjith_nair — Thu, 23 Jul 2020 04:51:16 GMT

@shashank_24, glad to know 🙂 . Appreciate an upvote and you may close the question by accepting as a solution