Getting Data In

How to search the average duration of REST API calls taken by each host and average elapsed CPU time?

diva_thilak
Engager
2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO  - End   : Duration= 000322                          CPU elapsed= 70.987723 - service: /AX_IServicesRESTAPI_v1

I have 7 hosts and the REST API service runs on all the 7 nodes. I need to figure out the average duration of the REST API calls taken by each node and the average CPU elapsed time.

How can I group by RESTAPI_V1 by host to calculate average duration and CPU elapsed?

0 Karma

jaymnr7
New Member

Hi,

I wanted to know how did you get this timing for each service (RESTAPI) call.
Can you please explain me about this. It would be very helpful for me.

Jay

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

Do a search for the events that contain RESTAPI and feed those results into the stats command

index=web *RESTAPI* | stats avg(Duration) by host

This assumes that the Duration field is being extracted, which it should, unless you have disabled kv extraction

diva_thilak
Engager

2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO - End : Duration= 000322 CPU elapsed= 70.987723 - service: /AX_IServicesRESTAPI_v1

2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO - End : Duration= 000022 CPU elapsed= 75.987723 - service: /AX_IServicesRESTAPI_v2

2015-08-13 22:23:10,530 UNKNOWN_USER [WebContainer : 9] INFO - End : Duration= 000002 CPU elapsed= 50.987723 - service: /AX_IServicesRESTAPI_v3

Thank you Sduff, if there are multiple rest services which are set to run on multiple nodes, how can i group by rest api service names and identify the average duration per host.

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

You'll probably need to 'rex' out the field you require

 index=web *RESTAPI* | rex field=_raw "service:(?<rest_service>.*)" | stats avg(Duration) by rest_service
0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...