https://community.splunk.com/t5/Monitoring-Splunk/Splunk-query-to-measure-REST-API-response-time/m-p/151285#M1737 <P>Looking for something like this??</P> <PRE><CODE>index=_internal sourcetype=splunkd_access source=*splunkd_access.log | rex "- - - (?P&lt;Response_Time&gt;.*)" | rex "\"(?&lt;REST_uri&gt;[^\"]+)" | table _time, REST_uri, Response_Time </CODE></PRE> Thu, 21 Nov 2013 19:59:32 GMT somesoni2 2013-11-21T19:59:32Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-query-to-measure-REST-API-response-time/m-p/151284#M1736 <P>Is there a query to measure the response time that Splunk takes to return results from REST API call?<BR /> The information should be in:</P> <P>index=_internal<BR /> sourcetype=splunkd_access<BR /> source=/opt/splunk/var/log/splunk/splunkd_access.log</P> <P>Thanks,<BR /> LP</P> Mon, 28 Sep 2020 15:20:24 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-query-to-measure-REST-API-response-time/m-p/151284#M1736 lpolo 2020-09-28T15:20:24Z https://community.splunk.com/t5/Monitoring-Splunk/Splunk-query-to-measure-REST-API-response-time/m-p/151285#M1737 <P>Looking for something like this??</P> <PRE><CODE>index=_internal sourcetype=splunkd_access source=*splunkd_access.log | rex "- - - (?P&lt;Response_Time&gt;.*)" | rex "\"(?&lt;REST_uri&gt;[^\"]+)" | table _time, REST_uri, Response_Time </CODE></PRE> Thu, 21 Nov 2013 19:59:32 GMT https://community.splunk.com/t5/Monitoring-Splunk/Splunk-query-to-measure-REST-API-response-time/m-p/151285#M1737 somesoni2 2013-11-21T19:59:32Z