I have a program logging out responses from a websocket endpoint to a file. I want to be able to get this data into Splunk and analyze it in the following way.
There are multiple updates to each unique response (depicted by "versions") on this websocket. For example, if I made 50 requests — the websocket would send me back a response per each request and keep updating it every x seconds until the websocket is closed.
I want to be able to:
- Count how many responses I've received (as the index is being populated)
- Make sure the response updates (denoted by versions) are being updated every x seconds, if they're not I don't want to count them
I have a response ID to uniquely specify each response in the logs and I have also have the version number and timestamp in the logs.
I want to know if this would be possible or is a good idea to do over Splunk — the main reason I thought of Splunk is because this involves real-time data, and because I want to be able to make a nice dashboard out of it.
