Knowledge Management

How to summary index the start & end time when a request is slow performing

sangs8788
Communicator

Hi,

I have a threshold defined for each request on what is normal it will take to process every 5mins. Below query checks and results the Requests which went beyond the normal threshold (defined in a lookup file) for every 5 mins. This logs an entry for every 5 mins.

earliest=-1h index=requestinfo  Request=*
| bin _time span=5m 
|stats P95(Response) AS "Response" by Request, _time
| lookup RequestThreshold.csv  Request OUTPUT NormalResponse
|eval Behaviour=case(Response > NormalResponse, "Abnormal", 1=1,"Normal") 
| search Behaviour="Abnormal"

My requirement is to run for past 1 month and also for future on a daily basis to get the continuous duration for which the Request was performing badly 95% of the time for every hour in a day, saying like 11 AM to 12 AM the R was beyond threshold. Again one more entry in saying same day 5:00 PM to 6:00PM it went beyond threshold. How do i achieve this ? Result something like below

START_TIME | END_TIME | R | Duration(s) | P95Response | Normal
10-04-2019 11:30 |10-04-2019 12:30 | Request1 | 3600| 35050 | 3000
10-04-2019 11:30 |10-04-2019 12:30 | Request2 |1800 | 590 | 300
10-04-2019 13:30 |10-04-2019 14:30 | Request1 |3600 | 89050 | 3000

Note that the Normal Threshold which is defined is for only 5mins range. So I am really confused on how to achieve this. Is this even possible?

0 Karma

somesoni2
Revered Legend

YOu want to calculate instance (of an hour) where 95% of the time in that hour Behaviour was Abnormal??
What about instances which span over two hour numbers (like first one in your example output)?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...