Splunk Enterprise

How to get the response time?

Vani_26
Path Finder

I have logs like shown below:

2022-03-09T13:22:45.345-01:00 [app_driver_group_stream_api-1] | INFO s.p.k.o.external.thread 345 - [applicationid=String, offset=100, CADM=String,  IPOD=String,  UniqueStringId=String, IMPT=000000-0000-000000-400-00000, applicationname=wwms-processor, Msgid=String, appId=app_group, EndToEndID=String, timestamp=17789552323] - app_thread [app_schema-677ghh89hhjjj-appThread-2] Processed 12 total count, run 0 quotations, and completed 0 total apps past the  last update
2022-03-09T13:22:45.345-01:00 [app_driver_group_stream_api-1] | INFO s.p.k.o.external.thread 345 - [applicationid=String, offset=100, CADM=String,  IPOD=String,  UniqueStringId=String, IMPT=000000-0000-000000-400-00000, applicationname=wwms-processor, Msgid=String, app=app_group_payment, EndToEndID=String, timestamp=17789552323] - app_thread [app_schema-677ghh89hhjjj-appThread-2] Processed 12 total count, run 0 quotations, and completed 0 total apps past the  last update

2022-03-10T12:10:45.345-01:00 [app_driver_group_stream_api-1] | INFO s.p.k.o.external.thread 345 - [applicationid=String, offset=100, CADM=String,  IPOD=String,  UniqueStringId=String, IMPT=000000-0000-000000-400-00000, applicationname=wwms-processor, Msgid=String, app=app_group_payment, EndToEndID=String, timestamp=17789552323] - app_thread [app_schema-677ghh89hhjjj-appThread-2] Processed 12 total count, run 0 quotations, and completed 0 total apps past the  last update


2022-03-15T10:44:45.345-01:00 [app_driver_group_stream_api-1] | INFO s.p.k.o.external.thread 345 - [applicationid=String, offset=100, CADM=String,  IPOD=String,  UniqueStringId=String, IMPT=000000-0000-000000-400-00000, applicationname=wwms-processor, Msgid=String, app=app_group_payment, EndToEndID=String, timestamp=17789552323] - app_thread [app_schema-677ghh89hhjjj-appThread-2] Processed 12 total count, run 0 quotations, and completed 0 total apps past the  last update

From the above logs i want to get the  min, max, avg, p95 and p99 response_time by app

i am not sure how to calculate the response time from the above logs by app.






Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

How would you calculate it by hand if you didn't have splunk? That is, what information in the log events would you use to make you calculation?

0 Karma

Vani_26
Path Finder

that's what is my question, like is there any chance to calculate the response time by seeing my sample logs, taking any data from the logs.

For example can i calculate the response time by app=app_group_payment.

I am not completely aware like how it works


0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to understand your data - if you don't, go back to the people who provided the data and get them to explain how you get the start and end time for the requests

0 Karma

Vani_26
Path Finder

@ITWhisperer Thankyou for your guidance

It really helped me.

Much appreciated

 

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...