Splunk Enterprise

How to calculate in customized query the response time from the logs below?

Ash1
Communicator

Hi All.
I am trying to calculate the response time from the logs below.

11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=100sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=10sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=50sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=40sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=130sec

 

 

 

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx  by PREFIX(completetime=)
|rename completetime= as Time
|timechart span=1d avg(Time) by host
|eval ResTime =round(,Time2)

 




When i am trying to run this query i am not bale to calculate the average of time because when i am doing PREFIX(completetime=) here sec word is also taking up.
How can i ignore it.

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the tonumber() function to extract only the digits from the Time field.

 

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx  by PREFIX(CompleteTime=)
|rename CompleteTime as Time
|eval Time=tonumber(Time)
|timechart span=1d avg(Time) as ResTime by host
|eval ResTime =round(ResTime, 2)

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

Ash1
Communicator

@richgalloway ,
when i tried to give tonumber i am still seeing Sec
|evak Time=tonumber(Time)

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

In that case, try this alternative that uses rex to extract only the digits from Time.

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx  by PREFIX(CompleteTime=)
|rename CompleteTime as Time
|rex field=Time "(?<Time>\d+)"
|timechart span=1d avg(Time) as ResTime by host
|eval ResTime =round(ResTime, 2)

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...