https://community.splunk.com/t5/Splunk-Search/Retrieve-slow-queries-in-splunk-search/m-p/87143#M22284 <P>Hi Guys,</P> <P>I am very new to splunk and operating on thew following data. I want to retrieve SQL queries which take more than 4 secs. My data looks like this,</P> <H1>Time: 130114 18:25:24</H1> <H1>User@Host: web-03-prod-01[web-03-prod-01] @ [10.2.2.88]</H1> <H1>Query_time: 4.137378 Lock_time: 0.000114 Rows_sent: 248 Rows_examined: 1777155</H1> <P>How can I use &gt; or &lt; operator to retrieve data which has a Query_time value more than 4 secs.</P> Mon, 28 Sep 2020 13:06:38 GMT pgadge 2020-09-28T13:06:38Z https://community.splunk.com/t5/Splunk-Search/Retrieve-slow-queries-in-splunk-search/m-p/87143#M22284 <P>Hi Guys,</P> <P>I am very new to splunk and operating on thew following data. I want to retrieve SQL queries which take more than 4 secs. My data looks like this,</P> <H1>Time: 130114 18:25:24</H1> <H1>User@Host: web-03-prod-01[web-03-prod-01] @ [10.2.2.88]</H1> <H1>Query_time: 4.137378 Lock_time: 0.000114 Rows_sent: 248 Rows_examined: 1777155</H1> <P>How can I use &gt; or &lt; operator to retrieve data which has a Query_time value more than 4 secs.</P> Mon, 28 Sep 2020 13:06:38 GMT https://community.splunk.com/t5/Splunk-Search/Retrieve-slow-queries-in-splunk-search/m-p/87143#M22284 pgadge 2020-09-28T13:06:38Z https://community.splunk.com/t5/Splunk-Search/Retrieve-slow-queries-in-splunk-search/m-p/87144#M22285 <P>First make sure you have the query time extracted as a field. See the following section in the docs: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime">http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime</A></P> <P>Then you can just do</P> <PRE><CODE>query_time&gt;4 </CODE></PRE> <P>in your search.</P> Tue, 15 Jan 2013 10:28:10 GMT https://community.splunk.com/t5/Splunk-Search/Retrieve-slow-queries-in-splunk-search/m-p/87144#M22285 Ayn 2013-01-15T10:28:10Z