How to search the average duration of REST API calls taken by each host and average elapsed CPU time?

[diva_thilak]

2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO  - End   : Duration= 000322                          CPU elapsed= 70.987723 - service: /AX_IServicesRESTAPI_v1

I have 7 hosts and the REST API service runs on all the 7 nodes. I need to figure out the average duration of the REST API calls taken by each node and the average CPU elapsed time.

How can I group by RESTAPI_V1 by host to calculate average duration and CPU elapsed?

[jaymnr7]

Hi,

I wanted to know how did you get this timing for each service (RESTAPI) call.
Can you please explain me about this. It would be very helpful for me.

Jay

[sduff_splunk]

Do a search for the events that contain RESTAPI and feed those results into the stats command

index=web *RESTAPI* | stats avg(Duration) by host

This assumes that the Duration field is being extracted, which it should, unless you have disabled kv extraction

[diva_thilak]

2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO - End : Duration= 000322 CPU elapsed= 70.987723 - service: /AX_IServicesRESTAPI_v1

2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO - End : Duration= 000022 CPU elapsed= 75.987723 - service: /AX_IServicesRESTAPI_v2

2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO - End : Duration= 000002 CPU elapsed= 50.987723 - service: /AX_IServicesRESTAPI_v3

Thank you Sduff, if there are multiple rest services which are set to run on multiple nodes, how can i group by rest api service names and identify the average duration per host.

[sduff_splunk]

You'll probably need to 'rex' out the field you require

 index=web *RESTAPI* | rex field=_raw "service:(?<rest_service>.*)" | stats avg(Duration) by rest_service