topic Re: Query to cumulate endpoint uri in Monitoring Splunk

Query to cumulate endpoint uri

saireddy — Mon, 06 Dec 2021 11:33:07 GMT

How to get cumulate response times for below endpoint.
Below is the query i tried. but need similar endpoints should be cumulated together instead of separate endpoint.

| stats values(pod) as HOST count avg(ReqProcessTime) as Avg p90(ReqProcessTime) as "Percentile90" max(ReqProcessTime) as Max by endpointURI, servicename, ResponseCode

Re: Query to cumulate endpoint uri

ITWhisperer — Mon, 06 Dec 2021 11:51:06 GMT

| eval endpointURI=replace(endpointURI,"[^/]+$","")

Re: Query to cumulate endpoint uri

saireddy — Mon, 06 Dec 2021 12:46:05 GMT

Thanks ,

Incase we if have static endpoint in the log. which is like below this is getting replaced by
/services/renewals/".

Original Endpoint - /services/renewals/renewaldetails

so, whenever there are common endpoints they should be added. if they are static it should display as is.