https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76962#M15736 <P>My log format is below:<BR /> 10.10.143.18 - "-" [21/Feb/2012:00:05:39 +0900] "POST /default/2881.ajax HTTP/1.1" 200 115538 "<A href="http://www.mycompany.com/index.jsp">http://www.mycompany.com/index.jsp</A>" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; InfoPath.1)"</P> <P>I can see the clientip, refer fields but not response time after indexing. How can I get it and sort it on demand?</P> Thu, 23 Feb 2012 03:44:19 GMT napo 2012-02-23T03:44:19Z https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76962#M15736 <P>My log format is below:<BR /> 10.10.143.18 - "-" [21/Feb/2012:00:05:39 +0900] "POST /default/2881.ajax HTTP/1.1" 200 115538 "<A href="http://www.mycompany.com/index.jsp">http://www.mycompany.com/index.jsp</A>" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; InfoPath.1)"</P> <P>I can see the clientip, refer fields but not response time after indexing. How can I get it and sort it on demand?</P> Thu, 23 Feb 2012 03:44:19 GMT https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76962#M15736 napo 2012-02-23T03:44:19Z https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76963#M15737 <P>What is the sourcetype of the input?</P> Thu, 23 Feb 2012 06:55:51 GMT https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76963#M15737 lguinn2 2012-02-23T06:55:51Z https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76964#M15738 <P>in your apache data sample i do not see any response time field value?</P> Thu, 23 Feb 2012 13:35:08 GMT https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76964#M15738 MarioM 2012-02-23T13:35:08Z https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76965#M15739 <P>Yes,there is no response time field. It should be logged on web application server. Thanks</P> Fri, 24 Feb 2012 09:06:31 GMT https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76965#M15739 napo 2012-02-24T09:06:31Z https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76966#M15740 <P>With Apache 2.4 the logging modul allows to activate New fields. One Field ist the prcocessing time. But the best is the New transaction id.</P> Fri, 24 Feb 2012 20:36:30 GMT https://community.splunk.com/t5/Getting-Data-In/Response-time-from-Apache-log/m-p/76966#M15740 jensihnow 2012-02-24T20:36:30Z