Splunk Enterprise

How to calculate in customized query the response time from the logs below?

Ash1
Communicator

Hi All.
I am trying to calculate the response time from the logs below.

11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=100sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=10sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=50sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=40sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=130sec

 

 

 

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx  by PREFIX(completetime=)
|rename completetime= as Time
|timechart span=1d avg(Time) by host
|eval ResTime =round(,Time2)

 




When i am trying to run this query i am not bale to calculate the average of time because when i am doing PREFIX(completetime=) here sec word is also taking up.
How can i ignore it.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the tonumber() function to extract only the digits from the Time field.

 

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx  by PREFIX(CompleteTime=)
|rename CompleteTime as Time
|eval Time=tonumber(Time)
|timechart span=1d avg(Time) as ResTime by host
|eval ResTime =round(ResTime, 2)

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Ash1
Communicator

@richgalloway ,
when i tried to give tonumber i am still seeing Sec
|evak Time=tonumber(Time)

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

In that case, try this alternative that uses rex to extract only the digits from Time.

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx  by PREFIX(CompleteTime=)
|rename CompleteTime as Time
|rex field=Time "(?<Time>\d+)"
|timechart span=1d avg(Time) as ResTime by host
|eval ResTime =round(ResTime, 2)

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...