How to get the list of all APIs with the response time more than 30sec in splunk

splunk6 — Fri, 10 May 2024 20:32:14 GMT

Hi All,

I have a soap request and response being ingested in the splunk under an index. There are multiple API calls available under the particular index="wireless_retail". How to get the list of all API calls under this index which consume RESPONSETIME > 30sec. My sample soap request and response in splunk is :

<getOrderServiceResponse xmlns=> <Case>90476491</Case> <SalesOrderId>8811662</SalesOrderId> <CustType>GW CONSUMER</CustType> <CustNodeId>4000593888</CustNodeId> <AccountId>4001293845</AccountId> <ServiceName>4372551943</ServiceName> <ServiceId>4000996500</ServiceId> <BillCyclePeriod>11/07/2023 - 06/19/2024</BillCyclePeriod> <NextBillDueDate>06/03/2024</NextBillDueDate> <TabAcctBalance/> <DeviceUnitPrice>0.00</DeviceUnitPrice> <DepositAcctBalance/> <tabAmount>0.00</tabAmount> <tabMonthlyFee>0.00</tabMonthlyFee> <tabDepletionRate>0.00</tabDepletionRate> <deviceOutrightCost>0.00</deviceOutrightCost> <deviceOutrightPayment>0.00</deviceOutrightPayment> <ConnectionFeeDetails> <connectionFee>45.00</connectionFee> <connectionFeePromoCode>CF9 Connection Fee Promo</connectionFeePromoCode> <connectionFeePromoValue>45.00</connectionFeePromoValue> <netConnectionFee>0.00</netConnectionFee> </ConnectionFeeDetails> </getOrderServiceResponse> </soapenv:Body> </soapenv:Envelope>", RETRYNO="0",, OPERATION="getOrderService", METHOD="SOAP", CONNECTORID="48169c3e-9d28-4b8f-9b9f-14ca83299cca", CONNECTORNAME="SingleView", CONNECTORTYPE="Application", CONNECTORSUBTYPE="SOAP", STARTTIME="1715367648945", ENDTIME="1715367688620", RESPONSETIME="39675",

So my sample API req is getOrderServiceResponse and getOrderServiceRequest. Like this there are multiple API calls available in the index. I want all the API calls along with the RESPONSETIME in a graph format to know which is consuming more than 30seconds. COuuld you please help?

Re: How to get the list of all APIs with the response time more than 30sec in splunk

PickleRick — Sat, 11 May 2024 07:33:15 GMT

OK. And what is your problem here? You've shown us some data sample (not in entirety though - it seems it's cut after a comma and we can't know if it's - for example - a well formed XML) but we don't know what have you tried so far and what isn't working the way you'd expect.

Do you have problems extracting fields? Or searching for matching data? Aggregating? Visualizing?

topic Re: How to get the list of all APIs with the response time more than 30sec in splunk in Splunk Search

How to get the list of all APIs with the response time more than 30sec in splunk

Re: How to get the list of all APIs with the response time more than 30sec in splunk