Dashboards & Visualizations

Find response time by transaction ids


I am trying to get response time for each of my services. However I end up using a wrong method to do this. 



track=prod app=servicename| stats by TrackingId



 How do i get just the avg response time based on TrackingId if say 2 events have the same TrackingId ?


2020-10-22 13:38:40.912 callerId=IndexConsumer, TrackingId=0db9610bb68a4097bee41ae95421936b app=servicename responseCode=500;elapsed=4968;responseLen=170]

2020-10-22 13:38:40.909 callerId=IndexConsumer, TrackingId=0db9610bb68a4097bee41ae95421936b app=servicename loggerclass=org.hibernate.engine.jdbc.spi.SqlExceptionHelper loggerline=142 loggermethod=logExceptions() loggerlevel=ERROR  


I want to use the singe number displayed chart to display this avg time duration. How do i do this ?

Labels (1)
Tags (1)
0 Karma

track=prod app=servicename
| stats earliest(_time) as start latest(_time) as end by TrackingId
| eval response=end-start
| stats avg(response)

This assumes that you are not just after the elapsed value from the log entry shown. Also, the problem with this method is that TrackingIds may span your time boundaries i.e. there could be entries before the time period starts for TrackingIds in the time period, and similarly entries after the time period ends which don't get included in the calculation giving lower response times.

If you just need the elapsed time from the log entry, assuming it isn't already extracted, you could use

| rex "elapsed=(?<elapsed>\d+)"
| stats avg(elapsed)
0 Karma


Have you tried this?

track=prod app=servicename
| stats avg(responseLen) as "avg response time" by TrackingId

Once you have the right result, click on the Visualization tab and choose the SingleValue viz.


If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...