Dashboards & Visualizations

Find response time by transaction ids

kgandhi91
Loves-to-Learn

I am trying to get response time for each of my services. However I end up using a wrong method to do this. 

 

 

track=prod app=servicename| stats by TrackingId

 

 

 How do i get just the avg response time based on TrackingId if say 2 events have the same TrackingId ?

 

2020-10-22 13:38:40.912 callerId=IndexConsumer, TrackingId=0db9610bb68a4097bee41ae95421936b app=servicename responseCode=500;elapsed=4968;responseLen=170]

2020-10-22 13:38:40.909 callerId=IndexConsumer, TrackingId=0db9610bb68a4097bee41ae95421936b app=servicename loggerclass=org.hibernate.engine.jdbc.spi.SqlExceptionHelper loggerline=142 loggermethod=logExceptions() loggerlevel=ERROR  

 

I want to use the singe number displayed chart to display this avg time duration. How do i do this ?

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
track=prod app=servicename
| stats earliest(_time) as start latest(_time) as end by TrackingId
| eval response=end-start
| stats avg(response)

This assumes that you are not just after the elapsed value from the log entry shown. Also, the problem with this method is that TrackingIds may span your time boundaries i.e. there could be entries before the time period starts for TrackingIds in the time period, and similarly entries after the time period ends which don't get included in the calculation giving lower response times.

If you just need the elapsed time from the log entry, assuming it isn't already extracted, you could use

| rex "elapsed=(?<elapsed>\d+)"
| stats avg(elapsed)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

track=prod app=servicename
| stats avg(responseLen) as "avg response time" by TrackingId

Once you have the right result, click on the Visualization tab and choose the SingleValue viz.

 

---
If this reply helps you, an upvote would be appreciated.
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>