Monitoring Splunk

Splunk query to measure REST API response time..

lpolo
Motivator

Is there a query to measure the response time that Splunk takes to return results from REST API call?
The information should be in:

index=_internal
sourcetype=splunkd_access
source=/opt/splunk/var/log/splunk/splunkd_access.log

Thanks,
LP

Tags (1)
0 Karma

somesoni2
Revered Legend

Looking for something like this??

index=_internal sourcetype=splunkd_access source=*splunkd_access.log | rex "- - - (?P<Response_Time>.*)" | rex "\"(?<REST_uri>[^\"]+)" | table _time, REST_uri, Response_Time
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...