topic how to find out average response time for all events by looking at two fields in same event msg ? in Splunk Search

how to find out average response time for all events by looking at two fields in same event msg ?

splunkDevendra — Thu, 15 Jul 2021 07:39:30 GMT

I've JSON Object in msg field as :

"objectA":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

I want to find out Average Total time taken by Successful responses i.e. in above example second attempts response time should be considered as it's success and not first attempts response time.
Total time taken = response time - requestTime;

so how to find out :
1. Average Response of All successful events found
2. Table with count for response time less than 1sec, between 1 sec to 2 sec, between 2sec to 3 sec, greater than 3 sec

Can you please help with Query ?

Thank you so much for your help and efforts.

Re: how to find out average response time for all events by looking at two fields in same event msg ?

splunkDevendra — Thu, 15 Jul 2021 07:43:06 GMT

Sample Data :

"objectA":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

"objectB":{
"aggrStatus":"FAILURE",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
}
]
}

"objectC":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

"objectD":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
]
}

Let's assume Object A to D are results of search. and in my case, Only Object A and C should be considered for calculation as they are success and object B and D are failure.

Re: how to find out average response time for all events by looking at two fields in same event msg ?

ITWhisperer — Thu, 15 Jul 2021 08:24:12 GMT

| rex "(?s)\"object\w\":(?<object>.*)" | spath input=object path=attempts{} output=attempts | mvexpand attempts | spath input=attempts path=responses{} output=responses | spath input=responses | where status="SUCCESS" | eval response=floor((responseTime-requestTime)/1000) | stats count by response