https://community.splunk.com/t5/Reporting/Generating-response-time-report/m-p/199004#M10666 <P>It'd probably be worth auto-extracting the response time into a field so that whenever you search for sourcetype "sfe" you have a field that represents response time. </P> <P>Then you'll have a field that you can perform statistical commands on, such as max, min, avg etc.</P> <P>With that in mind I'd create props.conf entry to hook into sourcetype sfe. Something like the below: </P> <P>props.conf: </P> <PRE><CODE>[sfe] EXTRACT_sfe_resp_time = ,(?&lt;resp_time&gt;\d{1,6})ms </CODE></PRE> <P>Then you could run your search through a timechart command something like this: </P> <P>sourcetype=sfe search.action | timechart avg(resp_time) by host</P> Tue, 25 Mar 2014 18:04:25 GMT dkuk 2014-03-25T18:04:25Z https://community.splunk.com/t5/Reporting/Generating-response-time-report/m-p/199003#M10665 <P>We have a search application with not so friendly formatted logging for reporting on. I'm having trouble extracting the response times from lines like below and then generating a response time report of some kind. Any suggestions?</P> <BLOCKQUOTE> <PRE><CODE>2014-03-25 12:00:10,827 INFO [com.search.web.common.filter.PerformanceFilter] - /global/search.action,364ms query=ABC </CODE></PRE> </BLOCKQUOTE> <P>Below is what I've come up with so far, but am stuck on how to accurately put the data into a report of some kind.</P> <BLOCKQUOTE> <PRE><CODE>sourcetype="sfe" search.action | regex_raw="\d{2,5}ms" </CODE></PRE> </BLOCKQUOTE> Tue, 25 Mar 2014 17:40:53 GMT https://community.splunk.com/t5/Reporting/Generating-response-time-report/m-p/199003#M10665 DFresh4130 2014-03-25T17:40:53Z https://community.splunk.com/t5/Reporting/Generating-response-time-report/m-p/199004#M10666 <P>It'd probably be worth auto-extracting the response time into a field so that whenever you search for sourcetype "sfe" you have a field that represents response time. </P> <P>Then you'll have a field that you can perform statistical commands on, such as max, min, avg etc.</P> <P>With that in mind I'd create props.conf entry to hook into sourcetype sfe. Something like the below: </P> <P>props.conf: </P> <PRE><CODE>[sfe] EXTRACT_sfe_resp_time = ,(?&lt;resp_time&gt;\d{1,6})ms </CODE></PRE> <P>Then you could run your search through a timechart command something like this: </P> <P>sourcetype=sfe search.action | timechart avg(resp_time) by host</P> Tue, 25 Mar 2014 18:04:25 GMT https://community.splunk.com/t5/Reporting/Generating-response-time-report/m-p/199004#M10666 dkuk 2014-03-25T18:04:25Z