Splunk Enterprise

How to get the response time?

Vani_26
Path Finder

I have logs like shown below:

2022-03-09T13:22:45.345-01:00 [app_driver_group_stream_api-1] | INFO s.p.k.o.external.thread 345 - [applicationid=String, offset=100, CADM=String,  IPOD=String,  UniqueStringId=String, IMPT=000000-0000-000000-400-00000, applicationname=wwms-processor, Msgid=String, appId=app_group, EndToEndID=String, timestamp=17789552323] - app_thread [app_schema-677ghh89hhjjj-appThread-2] Processed 12 total count, run 0 quotations, and completed 0 total apps past the  last update
2022-03-09T13:22:45.345-01:00 [app_driver_group_stream_api-1] | INFO s.p.k.o.external.thread 345 - [applicationid=String, offset=100, CADM=String,  IPOD=String,  UniqueStringId=String, IMPT=000000-0000-000000-400-00000, applicationname=wwms-processor, Msgid=String, app=app_group_payment, EndToEndID=String, timestamp=17789552323] - app_thread [app_schema-677ghh89hhjjj-appThread-2] Processed 12 total count, run 0 quotations, and completed 0 total apps past the  last update

2022-03-10T12:10:45.345-01:00 [app_driver_group_stream_api-1] | INFO s.p.k.o.external.thread 345 - [applicationid=String, offset=100, CADM=String,  IPOD=String,  UniqueStringId=String, IMPT=000000-0000-000000-400-00000, applicationname=wwms-processor, Msgid=String, app=app_group_payment, EndToEndID=String, timestamp=17789552323] - app_thread [app_schema-677ghh89hhjjj-appThread-2] Processed 12 total count, run 0 quotations, and completed 0 total apps past the  last update


2022-03-15T10:44:45.345-01:00 [app_driver_group_stream_api-1] | INFO s.p.k.o.external.thread 345 - [applicationid=String, offset=100, CADM=String,  IPOD=String,  UniqueStringId=String, IMPT=000000-0000-000000-400-00000, applicationname=wwms-processor, Msgid=String, app=app_group_payment, EndToEndID=String, timestamp=17789552323] - app_thread [app_schema-677ghh89hhjjj-appThread-2] Processed 12 total count, run 0 quotations, and completed 0 total apps past the  last update

From the above logs i want to get the  min, max, avg, p95 and p99 response_time by app

i am not sure how to calculate the response time from the above logs by app.






Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How would you calculate it by hand if you didn't have splunk? That is, what information in the log events would you use to make you calculation?

0 Karma

Vani_26
Path Finder

that's what is my question, like is there any chance to calculate the response time by seeing my sample logs, taking any data from the logs.

For example can i calculate the response time by app=app_group_payment.

I am not completely aware like how it works


0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to understand your data - if you don't, go back to the people who provided the data and get them to explain how you get the start and end time for the requests

0 Karma

Vani_26
Path Finder

@ITWhisperer Thankyou for your guidance

It really helped me.

Much appreciated

 

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...