Splunk Search

Response Time with hour intervals

denisevw
Path Finder

I posted a question earlier this month regarding Response Time with an additional calculation.

What I need now, is help with doing the same search, but with a timechart, hourly interval.
Example
Time Average Response Time
date 13:00 0.528
date 14:00 0.896
etc.

My current search is
index=myindex* host="server" Message_Type="99*" OR Message_Type="91*" OR Message_Type="92*" OR Message_Type="94*" source=EasyPayVAGAS | dedup Message_Type, UUID | stats first(_time) as begin last(_time) as end by UUID | eval responsetime=begin-end | eval Response_Time=if(responsetime>45,"45.000",responsetime) | stats avg(Response_Time) as Response_Time | eval RT_Avg=round(Response_Time,3) | table RT_Avg

Any assistance will be appreaciated, thanks!

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

index=myindex host="server" Message_Type="99" OR Message_Type="91" OR Message_Type="92" OR Message_Type="94" source=EasyPayVAGAS* | dedup Message_Type, UUID | eval Time=_time | bucket span=1h _time | stats first(Time) as begin last(Time) as end by UUID,_time| eval responsetime=begin-end | eval Response_Time=if(responsetime>45,"45.000",responsetime) | timechart span=1h avg(Response_Time) as RT_Avg | eval RT_Avg=round(RT_Avg,3) 

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this

index=myindex host="server" Message_Type="99" OR Message_Type="91" OR Message_Type="92" OR Message_Type="94" source=EasyPayVAGAS* | dedup Message_Type, UUID | eval Time=_time | bucket span=1h _time | stats first(Time) as begin last(Time) as end by UUID,_time| eval responsetime=begin-end | eval Response_Time=if(responsetime>45,"45.000",responsetime) | timechart span=1h avg(Response_Time) as RT_Avg | eval RT_Avg=round(RT_Avg,3) 

denisevw
Path Finder

Manage to get the search working with the results I need.
..my searches.. | eval Time=_time | bucket span=1h _time | stats first(Time) as begin last(Time) as end by UUID,_time | eval responsetime=begin-end | eval Response_Time=if(responsetime>45,"45.000",responsetime) | timechart span=1h avg(Response_Time) as RT_Avg

Thanks for your assistance "somesoni2"

0 Karma

denisevw
Path Finder

Yes, it returns UUID, _time, begin, end
Now for the calculation
Added "| eval responsetime=begin-end | eval Response_Time=if(responsetime>45,"45.000",responsetime)" and it displays the results correct.
All I need now is to add each UUID which displays the same hour (13:00 or 17:00) together.
Any suggestions on a calculation/search for adding result with the same time?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Does this returns anything?

index=myindex host="server" Message_Type="99" OR Message_Type="91" OR Message_Type="92" OR Message_Type="94" source=EasyPayVAGAS* | dedup Message_Type, UUID | eval Time=_time | bucket span=1h _time | stats first(Time) as begin last(Time) as end by UUID,_time

denisevw
Path Finder

Thanks for the quick response.
The search did not return any result.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...