topic Re: How to filter by time in Splunk Search

How to filter by time

ycherbi — Sun, 21 Jun 2020 16:31:39 GMT

Hi,

I am using Splunk to monitor our REST API calls

search is

index=prod-* "WEBSERVICES CALL ENDED"

it gives me results, but I want to get only results when time> 5000 ms

or get the slowest API response time by time field?

hoe can I do it?

Re: How to filter by time

richgalloway — Sun, 21 Jun 2020 18:32:49 GMT

We need more information. Please share some same (anonymized) data.

Re: How to filter by time

ycherbi — Mon, 22 Jun 2020 16:02:48 GMT

Hi,

Thank you for your reply,I will add more info

so this is my search

index=prod-* "WEBSERVICES CALL ENDED"

It will return records that indicate about my API call end (see image below)

As you can see we have processing time field in our logs and also time field (by Splunk) both are equal, I would to use this time field and get only API calls that processing time is longer than 5000ms ( add alerts).

Or get average API time, hope it more clear now

Re: How to filter by time

to4kawa — Sun, 21 Jun 2020 21:17:26 GMT

index=prod-* "WEBSERVICES CALL ENDED"

|rex field=time "(<time>\d+)"

|where time>5000

fire alert: event count > 0

Re: How to filter by time

ycherbi — Sun, 21 Jun 2020 23:02:37 GMT

Hi,

It didn't work got this error:

Error in 'rex' command: The regex '(<time>\d+)' does not extract anything. It should specify at least one named group. Format: (?<name>...).

The search job has failed due to an error. You may be able view the job in....

I tried also but no results

index=prod-* "WEBSERVICES CALL ENDED"

|rex field=time "processing time:<(?<time>.*)> ms"

|where time>10

Re: How to filter by time

ycherbi — Sun, 21 Jun 2020 23:04:12 GMT

Also this didnt work

index=prod-* "WEBSERVICES CALL ENDED"

|rex field=time "(?<time>.*)"

|where time>23

Re: How to filter by time

ycherbi — Sun, 21 Jun 2020 23:28:20 GMT

found it

index=prod-* "WEBSERVICES CALL ENDED"

|rex field=time "(?<time>\d+)"

|where time>1000

Re: How to filter by time

to4kawa — Mon, 22 Jun 2020 09:05:41 GMT

good job. please accept your answer. and I'm sorry for typo.