Splunk Enterprise

How to plot response time against _time field

shashank_24
Path Finder

Hi, I am trying to plot the response time values against _time field. I am aware of the timechart and stats command which i can use to calculate the average or percentile but what i would want is to plot the actual values over time.

I have the below query where I want field responseTime on y-axis vs _time on x-axis with actual values and not the average. Is that possible to do without using transforming commands?

index=test host="serverer-p*" RESPONSE "uri=[/checkout/my-app]" 
| rex field=_raw"\[(?<responseTime>[^\s]+)"

 

Labels (1)
Tags (3)
0 Karma

renjith_nair
Legend

What happens if you just add

|table _time,responseTime  and select a visualization

---
What goes around comes around. If it helps, hit it with Karma 🙂

shashank_24
Path Finder

@renjith_nair You would say I was stupid. I was actually trying that but instead of table I was using fields command. With table command it works. Thank you.

index=test host="serverer-p*" RESPONSE "uri=[/checkout/my-app]" 
| rex field=elapsedTime "\[(?<responseTime>[^\s]+)"
| table _time responseTime

 

0 Karma

renjith_nair
Legend

@shashank_24, glad to know 🙂 .  Appreciate an upvote and you may close the question by accepting as a solution

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...