Is it possible to create multiple duration time graphs?

[kumar497]

Hi 

i am trying to plot a timechart for multiple duration windows which service is taking time to respond inorder to segregate how many requests are breaching SLA based on this timeline , is it possible to plot this kind of computation ?

 index=<<index name>>  | rex field=_raw "duration=(?<Time>.*?)," |  search (>200 OR >250 OR >300 OR >350) | chart or timechart by Timeduration

 example : each request has its own response time like 300, 350 ,260,360ms for each request so wanted to look for the chart or timechart based on the requests taking >200 count, >250 count, >300 count > 350 count as this has overlapping aswell to rule out how many requests are falling in each time span, can i get a help pls

Thanks in advance 

[gcusello]

Hi @kumar497,

some questions:

• when you say "| search (>200 OR >250 OR >300 OR >350)", you are speaking of "| search duration>200 OR duration>250 OR duration>300 OR duration>350)", is it correct?
• why didn't you used only duration>350 or do you want a categorization or the resposes?
• what is "Timeduration"?

Ciao.

Giuseppe

[kumar497]

Hi @gcusello 

Thanks 

• when you say "| search (>200 OR >250 OR >300 OR >350)", you are speaking of "| search duration>200 OR duration>250 OR duration>300 OR duration>350)", is it correct?  -- yes 
• why didn't you used only duration>350 or do you want a categorization or the resposes? -- looking for the categorisation of the responses based on each baseline value like no of events with duration > 200 and with duration > 300 etc 
• what is "Timeduration"? -- this is simply time field (time taken by the service to respond)

[gcusello · Accepted solution]

Hi @kumar497,

ok, I suppose that Timeduration is the classification of the duration, in this case, please try something like this:

index=<index_name>  
| rex "duration\=(?<Time>.[^,]?)" 
| eval Timeduration=case(Time>350,">350", Time>300,">300", Time>250,">250", Time>200,">200")
| timechart count BY Timeduration

Ciao.

Giuseppe

[kumar497]

Thanks  it works 

[gcusello]

Hi @kumar497,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉