Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Get response time from webserver access logs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Get response time from webserver access logs
Hi,
I am trying to get avg response time in a time frame from below web server access logs.
hostname:port 198.x.x.x - - - [29/Sep/2017:15:20:28 +0000] "POST /vendor-service-v2.1/VendorServiceProvider/v2.1.0 HTTP/1.1" 200 0/18688 1205 "-" "SAP NetWeaver Application Server (1.0;731)".
Here in above logs 0/18688 is the response time ( format is %T( time in seconds)/%D( time in micro seconds)).
Any help is much appreciated.
Thanks
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this!
(your search)|rex field=_raw "^.\".\"\s\d*\s(?< response_time>[0-9/])\s.$"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I tried this, it isn't giving me any results and sorry my question should be to get the avg response time in a given time frame.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, you just want to extract the "0/18688" thru rex or something else you want
can you post few more webserver access logs samples please..
Sekar
PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes I want to extract just that and below are more logs.
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:17 +0000] "POST /manage-service-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/275844 4581 "-" "IBM WebServices/1.0"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:17 +0000] "POST /manage-service-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/538517 896 "-" "-"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:17 +0000] "POST /manage-ervice-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/242675 2762 "-" "-"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:18 +0000] "POST /manage-service-v1.1/ManageProvider/v1.1.0 HTTP/1.1" 200 0/16996 1249 "-" "-"- 172.23.176.4 - - - [04/Oct/2017:00:05:18 +0000] "GET /" 200 0/1258 195 "-" "-"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:18 +0000] "POST /manage-service-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/23896 1701 "-" "SAP NetWeaver Application Server (1.0;731)"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:19 +0000] "POST /manage-credit-service-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/26037 942 "-" "SAP NetWeaver Application Server (1.0;731)"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:19 +0000] "POST /manage-credit-service-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/248812 987 "-" "IBM WebServices/1.0"
naming syntax -- (?)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes I want to extract just that and below are more logs.
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:17 +0000] "POST /manage-service-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/275844 4581 "-" "IBM WebServices/1.0"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:17 +0000] "POST /manage-service-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/538517 896 "-" "-"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:17 +0000] "POST /manage-ervice-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/242675 2762 "-" "-"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:18 +0000] "POST /manage-service-v1.1/ManageProvider/v1.1.0 HTTP/1.1" 200 0/16996 1249 "-" "-"- 172.23.176.4 - - - [04/Oct/2017:00:05:18 +0000] "GET /" 200 0/1258 195 "-" "-"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:18 +0000] "POST /manage-service-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/23896 1701 "-" "SAP NetWeaver Application Server (1.0;731)"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:19 +0000] "POST /manage-credit-service-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/26037 942 "-" "SAP NetWeaver Application Server (1.0;731)"
hostname:port 192.X.X.X - - - [04/Oct/2017:00:05:19 +0000] "POST /manage-credit-service-v2.1/ManageProvider/v2.1.0 HTTP/1.1" 200 0/248812 987 "-" "IBM WebServices/1.0"
naming syntax -- (?)
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
