Dashboards & Visualizations

Find response time by transaction ids

kgandhi91
Loves-to-Learn

I am trying to get response time for each of my services. However I end up using a wrong method to do this. 

 

 

track=prod app=servicename| stats by TrackingId

 

 

 How do i get just the avg response time based on TrackingId if say 2 events have the same TrackingId ?

 

2020-10-22 13:38:40.912 callerId=IndexConsumer, TrackingId=0db9610bb68a4097bee41ae95421936b app=servicename responseCode=500;elapsed=4968;responseLen=170]

2020-10-22 13:38:40.909 callerId=IndexConsumer, TrackingId=0db9610bb68a4097bee41ae95421936b app=servicename loggerclass=org.hibernate.engine.jdbc.spi.SqlExceptionHelper loggerline=142 loggermethod=logExceptions() loggerlevel=ERROR  

 

I want to use the singe number displayed chart to display this avg time duration. How do i do this ?

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
track=prod app=servicename
| stats earliest(_time) as start latest(_time) as end by TrackingId
| eval response=end-start
| stats avg(response)

This assumes that you are not just after the elapsed value from the log entry shown. Also, the problem with this method is that TrackingIds may span your time boundaries i.e. there could be entries before the time period starts for TrackingIds in the time period, and similarly entries after the time period ends which don't get included in the calculation giving lower response times.

If you just need the elapsed time from the log entry, assuming it isn't already extracted, you could use

| rex "elapsed=(?<elapsed>\d+)"
| stats avg(elapsed)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

track=prod app=servicename
| stats avg(responseLen) as "avg response time" by TrackingId

Once you have the right result, click on the Visualization tab and choose the SingleValue viz.

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...