Total time taken per request

puneetgureja — Fri, 14 May 2021 13:42:44 GMT

new to Splunk so want to know how I can fetch total time take per request

applog.msg=XXXX_Logs,CorrelationId=XXXXXXXXXX,URL=XXXX.com,ServiceKey=xyzService,No_Of_Requests=4,Total_Time_Taken=3

Total time taken = Total_Time_Taken/ No_Of_Requests

Re: Total time taken per request

aasabatini — Fri, 14 May 2021 14:16:10 GMT

Hi @puneetgureja

I don't know if your field are extracted

if the field are extracted you only need a eval condition

eval "Total time taken"=Total_Time_Taken/ No_Of_Requests

if you need to extract the fields before needs a rex comand

| rex field=_raw "No_Of_Requests=(?<no_of_requests>\d+),Total_Time_Taken=(?<total_time_taken>\d+)" | eval "Total time taken"=Total_Time_Taken/ No_Of_Requests

anyway I suggest to extract the field with an automatic KEy-value extraction

https://docs.splunk.com/Documentation/Splunk/8.1.3/Knowledge/Automatickey-valuefieldextractionsatsearch-time

topic Re: Total time taken per request in Splunk Search

Total time taken per request

Re: Total time taken per request