Alerting

Docker log response time metrics

saireddy
Loves-to-Learn Lots

Can you please help, how to construct stats  metrics for the below docker logs.

ThreadID=124;ThreadIDHex=0000007c;ThreadName=[XNIO-2 task-32];Node=XXXXXX;TransID=;ConsumerSenderID=NA;URI=/getBaselinedcategorylist;ServiceName=findXXXX;TranasactionStartTime=;TransactionEndTime=2021-11-05 05:34:34.366;TotalResponseTime=;TransactionStatus=SUCCESS;Method=GET;StatusCode=200;ErrorMsg=;CaptureLocation=MicroserviceResponse;
ThreadID=124;ThreadIDHex=0000007c;ThreadName=[XNIO-2 task-32];Node=XXXXXX;TransID=;ConsumerSenderID=NA;URI=/getBaselinedcategorylist;ServiceName=findXXXX;TranasactionStartTime=2021-11-05 05:34:34.264;TransactionEndTime=;TotalResponseTime=;TransactionStatus=;Method=GET;StatusCode=;ErrorMsg=;CaptureLocation=MicroserviceRequest;


status should give transactioncount , transactionstatus, average, 90thP URI Method.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What do you have so far?

For example, have you extracted the fields you are interested in or is that the part you need help with?

How do you know these two events are related to each other?

Has _time already been correctly extracted from the log entries for each event?

0 Karma

saireddy
Loves-to-Learn Lots

I tried something like this

index=docker_* source="/applogs/containers/fob*" 
| rex field=source "/applogs/containers/(?<ServiceName>.*?)\."
| stats count(ThreadIDHex) as "Transaction Count" min(_time) as starttime max(_time) as endtime range(_time) as duration by ServiceName URI

Regarding how they are related, threadid and threadihex for both the logs are same. 

Tags (2)
0 Karma

saireddy
Loves-to-Learn Lots

Can anyone help?

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...