Getting Data In

How to search the average duration of REST API calls taken by each host and average elapsed CPU time?

diva_thilak
Engager
2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO  - End   : Duration= 000322                          CPU elapsed= 70.987723 - service: /AX_IServicesRESTAPI_v1

I have 7 hosts and the REST API service runs on all the 7 nodes. I need to figure out the average duration of the REST API calls taken by each node and the average CPU elapsed time.

How can I group by RESTAPI_V1 by host to calculate average duration and CPU elapsed?

0 Karma

jaymnr7
New Member

Hi,

I wanted to know how did you get this timing for each service (RESTAPI) call.
Can you please explain me about this. It would be very helpful for me.

Jay

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Do a search for the events that contain RESTAPI and feed those results into the stats command

index=web *RESTAPI* | stats avg(Duration) by host

This assumes that the Duration field is being extracted, which it should, unless you have disabled kv extraction

diva_thilak
Engager

2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO - End : Duration= 000322 CPU elapsed= 70.987723 - service: /AX_IServicesRESTAPI_v1

2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO - End : Duration= 000022 CPU elapsed= 75.987723 - service: /AX_IServicesRESTAPI_v2

2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO - End : Duration= 000002 CPU elapsed= 50.987723 - service: /AX_IServicesRESTAPI_v3

Thank you Sduff, if there are multiple rest services which are set to run on multiple nodes, how can i group by rest api service names and identify the average duration per host.

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

You'll probably need to 'rex' out the field you require

 index=web *RESTAPI* | rex field=_raw "service:(?<rest_service>.*)" | stats avg(Duration) by rest_service
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...