Average response time for group of API

[Harish429]

Hi Team,

I want to create a splunk dashboard with the avearge response time taken by the all the API's wich follow this condition.

Example:

I have below API's

/api/cvraman/book

/api/apj/book

/api/nehru/book

/api/cvraman/collections

/api/apj/collections

/api/indira/collections

/api/rahul/notes

/api/rajiv/notes

/api/modi/notes

Now i will check for the average of the API /api/*/book,/api/*/collections,/api/*/notes.

Dashboard should have only these response times in the chart /api/*/book,/api/*/collections,/api/*/notes.

i tried the below query but the dashboard shows the combined average on all the three can someone please help on this

index=your_index (URI = /api/*/book OR URI = /api/*/collections OR /api/*/notes. ) |stats avg(duration) as avg_time

[Harish429]

Not exactly like the above one.But the ouput should be a chart with x-axis /api/*/book,api/*/collections and api/*/notes and Y-axis should be the response time 

[ITWhisperer]

Just use a line chart or column chart as your visualisation.

[Harish429]

Not this way what i need is  suppose

/api/cvraman/book - took 1msec for response

/api/apj/book-took 2msec for response

/api/nehru/book-took  3 msec for response

/api/cvraman/collections -took 1msec for response

/api/apj/collections-took 3msec for response

/api/indira/collections-took 5msec for response

/api/rahul/notes-took 1msec for response

/api/rajiv/notes-took 4msec for response

/api/modi/notes-took 6msec for response

Now in the chart i should have only three API,

/api/*/book -calculate the average of /api/cvraman/book ,/api/apj/book,/api/nehru/book
/api/*/collections -same average of collections API
/api/*/notes-same average of notes API

[ITWhisperer]

| rex mode=sed field=URI "s/(?<root>\/\w+\/)[^\/]+(?<api>.*)/\1*\2/g"
| stats avg(duration) as avg_time by URI

[Harish429]

Thank you for the response.

But this gives me all the API's average response time.

If i just need the resposnse of the api which mich only /api/*/Book ,/api/*/collections/,/api/*/notes then what would be the rex statement

[ITWhisperer]

Here is a runanywhere example using random durations showing the average of the APIs - how is this different to what you have asked for

| makeresults count=10
| eval _raw="/api/cvraman/book
/api/apj/book
/api/nehru/book
/api/cvraman/collections
/api/apj/collections
/api/indira/collections
/api/rahul/notes
/api/rajiv/notes
/api/modi/notes"
| multikv noheader=t 
| eval duration=random()%10
| rename _raw as URI
``` The lines above create dummy data ```
| rex mode=sed field=URI "s/(?<root>\/\w+\/)[^\/]+(?<api>.*)/\1*\2/g"
| stats avg(duration) as avg_time by URI

[Harish429]

May be i guess i have not communicated Clearly.

the final output should have only three API

Just like this

[ITWhisperer]

Correct, but it clearer now; thank you.

Try it this way

| rex mode=sed field=URI "s/(?<root>\/\w+\/)[^\/]+(?<api>.*)/\1*\2/g"
| eval responseTime="response time"
| chart avg(duration) as avg_time by responseTime URI

You can set the x-axis Title to "None"

[Harish429]

The above rex will give all the APIS.

For example we have another API  /API/*/workbooks.Now with the query you provided it would give the values of this API also.I dont want that.

I just need values of  /API/*/Books,./API/*/collections,/API/*/Notes only.

[ITWhisperer]

The filter on your search should be only including the events you want - if you have other events, you need to tighten the filter to exclude the unwanted events. Can you share an example of the events which are being included which should not be based on your filter?

[Harish429]

thats the production data so i couldnt share here.but from the results i can see that it is give the results of /api/*/Workbook,/api/* /testbooks responses also. which i dont need this.

Actually prod api's i renamed and just added workbook ,testbooks,notes like that.

Hope you understand

[ITWhisperer]

Understood. So, it sounds like your filter isn't working effectively. Here is a runanywhere example showing the filter working on the sample data with Workbook and testbook being excluded from the results

| makeresults count=10
| eval _raw="/api/cvraman/book
/api/apj/book
/api/nehru/book
/api/nehru/Workbook
/api/nehru/testbook
/api/cvraman/collections
/api/apj/collections
/api/indira/collections
/api/rahul/notes
/api/rajiv/notes
/api/modi/notes"
| multikv noheader=t 
| eval duration=random()%10
| rename _raw as URI
| search (URI = /api/*/book OR URI = /api/*/collections OR URI = /api/*/notes)
| rex mode=sed field=URI "s/(?<root>\/\w+\/)[^\/]+(?<api>.*)/\1*\2/g"
| eval responseTime="response time"
| chart avg(duration) as avg_time by responseTime URI

I am sure you can also understand that there is nothing wrong with the rex and the remainder of the search given the data examples you have given to work on, and that the issue is with your filter, which only you can sort out, given that it is production data that you cannot share.

[ITWhisperer]

Do you mean something like this

index=your_index (URI = /api/*/book OR URI = /api/*/collections OR /api/*/notes. ) |stats avg(duration) as avg_time by URI

[Harish429]

Not exactly like the above one.But the ouput should be a chart with x-axis /api/*/book,api/*/collections and api/*/notes and Y-axis should be the response time