topic range(_time) help ?? in Splunk Search

range(_time) help ??

rakesh_498115 — Mon, 28 Sep 2020 12:48:38 GMT

I have bulk of 1 lakh events in my logs . I have used the stats(_range) command to calculate the average response time of all the transactions , but then for few transactions i couldnt see the proper values coming .. i.e if i use the transcation command i am getting the desired results but its taking too much of time .. so i tried with stats range(_time) but its not getting correct results..

Stats Query ::

index="apps" ("Request document" OR "Response document") | stats range(_time) as duration by Product

This Query is not working i.e showing improper stats . so i have used the transaction query as below but its taking so much of time to execute.

Transaction Query ::

index="apps" ("Request document" OR "Response document") | stats avg(_time) as duration by Product

Please help Or Suggest a better way to calucate the avg response time..i have huge amount of requests per hr say 1 lakh nd in need the stats for over 24 hrs period.

index="apps" ("Request document" OR "Response document") | transaction keepevicted=true Product | table Product,duration

Re: range(_time) help ??

Ayn — Thu, 15 Nov 2012 12:01:55 GMT

A few things. First of all, what is "lakh" and "nd"?

Secondly, it's no wonder that your stats query isn't working - you're taking an average value of the events' epoch timestamps, which is in no way related to durations. Judging by your transaction query that is reportedly working I don't see why you want an average value in your stats query? To get the duration by product, you could get the last _time value and subtract the first _time value from that.

... | stats earliest(_time),latest(_time) by Product | eval duration=latest(_time)-earliest(_time) | table Product,duration

Re: range(_time) help ??

martin_mueller — Thu, 15 Nov 2012 12:04:27 GMT

avg(_time) calculates the average of the event timestamps, not any kind of time delay.

Assuming each Product has exactly one request and response event, you can compute the difference between the maximum and minimum _time to get the response time.

Concerning the transaction run duration, you can fine-tune that by setting maxspan/maxpause.

Re: range(_time) help ??

martin_mueller — Thu, 15 Nov 2012 12:05:16 GMT

One lakh is 100000.

Re: range(_time) help ??

rakesh_498115 — Fri, 16 Nov 2012 07:41:13 GMT

Hi Ayn,

Its not average actually , i need the time difference between the request and respone . so i have used range(_time) .. but this is not giving proper results .can you pls help me on this .

Re: range(_time) help ??

Ayn — Fri, 16 Nov 2012 08:22:09 GMT

Ah yes, range would do it as well. I AM trying to help you, but I don't see any response to what I suggested. What's not working? What are expected results, and what are you in fact getting?

Re: range(_time) help ??

rakesh_498115 — Sat, 17 Nov 2012 13:46:23 GMT

Even the mentioned query worked for me Ayn..thanx