https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349245#M103392 <P>I think kamlesh has nailed this for you, with one minor tweak.</P> <PRE><CODE> index=gee_sit | eval responseTime=TransactionSentEndtime - TransactionReceivedStartTime | eval responseTime=round((responseTime/1000),3) | lookup SolutionCenter.csv TargetBasePath OUTPUTNEW APIName | stats avg(responseTime) by APIName </CODE></PRE> Tue, 19 Dec 2017 10:46:51 GMT nickhills 2017-12-19T10:46:51Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349239#M103386 <P>How to get response time from my search?</P> <P>APIName is from my inputlookup</P> <PRE><CODE>|inputlookup SolutionCenter.csv | append [search index=gee_sit |eval responseTime=TransactionSentEndtime - TransactionReceivedStartTime|eval responseTime=round((responseTime/1000),3)|stats avg(responseTime) by TargetBasePath ]|stats avg(responseTime) by TargetBasePath APIName </CODE></PRE> Tue, 19 Dec 2017 09:30:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349239#M103386 karthi2809 2017-12-19T09:30:14Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349240#M103387 <P>Can you share some event data?</P> Tue, 19 Dec 2017 09:39:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349240#M103387 nickhills 2017-12-19T09:39:46Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349241#M103388 <P>Hi @karthi2809,</P> <P>what is the relationship OR mapping between lookup and search data?? Is that any field in lookup file which can be mapped with TargetBasePath to fetch APIName?.</P> Tue, 19 Dec 2017 09:41:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349241#M103388 kamlesh_vaghela 2017-12-19T09:41:01Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349242#M103389 <P>yes i mapped with TargetBasePath to fetch APIName</P> Tue, 19 Dec 2017 09:44:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349242#M103389 karthi2809 2017-12-19T09:44:52Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349243#M103390 <P>Then can you please try this?</P> <PRE><CODE>index=gee_sit | eval responseTime=TransactionSentEndtime - TransactionReceivedStartTime | eval responseTime=round((responseTime/1000),3) | stats avg(responseTime) by TargetBasePath | lookup SolutionCenter.csv TargetBasePath OUTPUT APIName </CODE></PRE> <P><A href="https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Lookup">https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Lookup</A></P> Tue, 19 Dec 2017 10:14:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349243#M103390 kamlesh_vaghela 2017-12-19T10:14:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349244#M103391 <P>Tue Dec 19 05:30:29 EST 2017Info: Trace: MessageID=66e0fb4b7a00 ; TransactionID=va10p40027-30801-14958502-24 ; URI=/v1/carealerts/message ; Environment=prod ; Proxy=CareAlerts-CORE-v1 ; TransactionReceivedStartTime=1513679429101 ; TransactionReceivedEndtime=1513679429102 ; RequestSentStartTime=1513679429109; RequestSentEndTime=1513679429109 ; ResponseReceivedStartTime=1513679429589 ; ResponseReceivedEndTime=1513679429590 ; TransationSentStartTime=1513679429600 ; TransactionSentEndtime=1513679429602 ; TargetHost=prods.com ; TargetBasePath=/CareManagement/1.0/CareAlertMessageRHI ; TargetCopySuffix=false ; TargetCopyQueryParams=true ; IsError=false ; Status=200 ; ErrorMsg=\x00</P> Tue, 19 Dec 2017 10:32:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349244#M103391 karthi2809 2017-12-19T10:32:03Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349245#M103392 <P>I think kamlesh has nailed this for you, with one minor tweak.</P> <PRE><CODE> index=gee_sit | eval responseTime=TransactionSentEndtime - TransactionReceivedStartTime | eval responseTime=round((responseTime/1000),3) | lookup SolutionCenter.csv TargetBasePath OUTPUTNEW APIName | stats avg(responseTime) by APIName </CODE></PRE> Tue, 19 Dec 2017 10:46:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349245#M103392 nickhills 2017-12-19T10:46:51Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349246#M103393 <P>One minor tweak. This helps reduce the event count getting to the eval and stats to be ones only with the field from your lookup. I would avoid the inputlookup with an append of a search as a pattern. Especially in large volume environments.</P> <PRE><CODE> index=gee_sit | lookup SolutionCenter.csv TargetBasePath OUTPUTNEW APIName | where isnotnull(APIName) | eval responseTime=TransactionSentEndtime - TransactionReceivedStartTime | eval responseTime=round((responseTime/1000),3) | stats avg(responseTime) by APIName </CODE></PRE> Tue, 19 Dec 2017 18:13:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349246#M103393 starcher 2017-12-19T18:13:43Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349247#M103394 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/23295">@nickhills</a>, <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/67425">@starcher</a>, If <CODE>stats</CODE> can be performed on <CODE>TargetBasePath</CODE> and then enriched with <CODE>lookup</CODE> command, the search will perform better. I think that is the point <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/127939">@kamlesh_vaghela</a> has made in his query. Following is the Splunk Docs reference for the same: <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Optimizing_your_lookup_search" target="_blank">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Lookup#Optimizing_your_lookup_search</A></P> Tue, 29 Sep 2020 17:18:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349247#M103394 niketn 2020-09-29T17:18:47Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349248#M103395 <P>great thanks you </P> Wed, 20 Dec 2017 05:50:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349248#M103395 karthi2809 2017-12-20T05:50:29Z https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349249#M103396 <P>Thanks a lot its working</P> Wed, 20 Dec 2017 05:51:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-response-time-from-this-search/m-p/349249#M103396 karthi2809 2017-12-20T05:51:29Z