topic Re: count by response time range in Splunk Search

count by response time range

jibiuthaman — Mon, 28 Sep 2020 16:00:14 GMT

source aaa| eval Description=case(rt_sec>10, "G10", rt_sec>20, "G20", rt_sec>30, "G30", rt_sec>40, "G40") | stats count by Description

this seems to only give me results for G10 even though I have many cases with response times greater then 10 sec... if i just do source aaa rt_sec > 20, I get results. Please help me find the issue here.

Re: count by response time range

somesoni2 — Thu, 27 Feb 2014 21:24:52 GMT

Try this.

source=aaa | eval Description=case(rt_sec>10 AND rt_sec<=20,"G10", rt_sec>20 AND rt_sec<=30,"G20",rt_sec>30 AND rt_sec<=40,"G40",rt_sec>40,"G10")| stats count by Description

Re: count by response time range

jibiuthaman — Fri, 28 Feb 2014 16:48:10 GMT

Work and thanks again..

Re: count by response time range

ksuyash — Fri, 18 Oct 2024 23:29:34 GMT

I'm having similar query but when using the below case .. onlt <=500 and >=1500 are getting counted in stats
duration =6000's are also getting counted in >1500ms case not sure why

index=* | rex "TxDurationInMillis=(?<TxDurationInMillis>\d+)" | eval ResponseTime = tonumber(TxDurationInMillis) | eval ResponseTimeCase=case( ResponseTime <= 500, "<=500ms", ResponseTime > 500 AND ResponseTime <= 1000, ">500ms and <=1000ms", ResponseTime > 1000 AND ResponseTime <= 1400, ">1000ms and <=1400ms", ResponseTime > 1400 AND ResponseTime < 1500, ">1400ms and <1500ms", ResponseTime >= 1500, ">=1500ms" ) | table TxDurationInMillis ResponseTime ResponseTimeCase