Is there a query to measure the response time that Splunk takes to return results from REST API call?
The information should be in:
index=_internal
sourcetype=splunkd_access
source=/opt/splunk/var/log/splunk/splunkd_access.log
Thanks,
LP
Looking for something like this??
index=_internal sourcetype=splunkd_access source=*splunkd_access.log | rex "- - - (?P<Response_Time>.*)" | rex "\"(?<REST_uri>[^\"]+)" | table _time, REST_uri, Response_Time