topic Re: How to group multiple methods responsetime into intervals and obtain count? in Splunk Search

How to group multiple methods responsetime into intervals and obtain count?

Splunk_321 — Tue, 09 May 2023 08:52:22 GMT

Hi All,

I have a requirement where I need to group count of methods responsetime into different time intervals.

Below is what I tried

basesearch | eval ResponseTime=if(uri=="/api/auth",null(),responsetime*1000) | rex field=gwrequesturi "(?<prefix>\S+)/locations/(?<method>\w+[^/?])" | table ResponseTime method

This is resulted in below output

ResponseTime	Method
330	A
1627	B
1025	B
3126	A
2034	B
..........................	...............

I have two possibilities for method (Say for ex: A and B)

I want to get results something like below (Responsetime and count of each method falling in that interval)

ResponseTime	A	B
<=1000	4	8
>1000 and <=3000	11	25
>3000 and <=5000	35	23
>5000	2	4

Can someone help me with the query!

Thanks in advance!

Re: How to group multiple methods responsetime into intervals and obtain count?

VatsalJagani — Tue, 09 May 2023 17:13:46 GMT

@Splunk_321 - try below search:

basesearch | eval ResponseTime=if(uri=="/api/auth",null(),responsetime*1000) | rex field=gwrequesturi "(?<prefix>\S+)/locations/(?<method>\w+[^/?])" | table ResponseTime method | eval category=case(ResponseTime<=1000,"<=1000", ResponseTime<=3000,">1000 and <=3000", ResponseTime<=5000,">3000 and <=5000", ResponseTime>5000,">5000") | chart count over category by Method

I hope this helps!!! Kindly upvote if it does!!!

Re: How to group multiple methods responsetime into intervals and obtain count?

Splunk_321 — Wed, 10 May 2023 04:49:37 GMT

This helps. Thank you for the solution!