topic Re: Response Time with hour intervals in Splunk Search

Response Time with hour intervals

denisevw — Mon, 28 Sep 2020 16:41:53 GMT

I posted a question earlier this month regarding Response Time with an additional calculation.

What I need now, is help with doing the same search, but with a timechart, hourly interval.
Example
Time Average Response Time
date 13:00 0.528
date 14:00 0.896
etc.

My current search is
index=myindex* host="server" Message_Type="99*" OR Message_Type="91*" OR Message_Type="92*" OR Message_Type="94*" source=EasyPayVAGAS | dedup Message_Type, UUID | stats first(_time) as begin last(_time) as end by UUID | eval responsetime=begin-end | eval Response_Time=if(responsetime>45,"45.000",responsetime) | stats avg(Response_Time) as Response_Time | eval RT_Avg=round(Response_Time,3) | table RT_Avg

Any assistance will be appreaciated, thanks!

Re: Response Time with hour intervals

somesoni2 — Thu, 22 May 2014 16:36:16 GMT

Try this

index=myindex host="server" Message_Type="99" OR Message_Type="91" OR Message_Type="92" OR Message_Type="94" source=EasyPayVAGAS* | dedup Message_Type, UUID | eval Time=_time | bucket span=1h _time | stats first(Time) as begin last(Time) as end by UUID,_time| eval responsetime=begin-end | eval Response_Time=if(responsetime>45,"45.000",responsetime) | timechart span=1h avg(Response_Time) as RT_Avg | eval RT_Avg=round(RT_Avg,3)

Re: Response Time with hour intervals

denisevw — Thu, 22 May 2014 18:08:18 GMT

Thanks for the quick response.
The search did not return any result.

Re: Response Time with hour intervals

somesoni2 — Mon, 28 Sep 2020 16:42:15 GMT

Does this returns anything?

index=myindex host="server" Message_Type="99" OR Message_Type="91" OR Message_Type="92" OR Message_Type="94" source=EasyPayVAGAS* | dedup Message_Type, UUID | eval Time=_time | bucket span=1h _time | stats first(Time) as begin last(Time) as end by UUID,_time

Re: Response Time with hour intervals

denisevw — Mon, 28 Sep 2020 16:42:21 GMT

Yes, it returns UUID, _time, begin, end
Now for the calculation
Added "| eval responsetime=begin-end | eval Response_Time=if(responsetime>45,"45.000",responsetime)" and it displays the results correct.
All I need now is to add each UUID which displays the same hour (13:00 or 17:00) together.
Any suggestions on a calculation/search for adding result with the same time?

Re: Response Time with hour intervals

denisevw — Mon, 28 Sep 2020 16:42:23 GMT

Manage to get the search working with the results I need.
..my searches.. | eval Time=_time | bucket span=1h _time | stats first(Time) as begin last(Time) as end by UUID,_time | eval responsetime=begin-end | eval Response_Time=if(responsetime>45,"45.000",responsetime) | timechart span=1h avg(Response_Time) as RT_Avg

Thanks for your assistance "somesoni2"