Splunk Search

Display Time Taken in Splunk response

jdhavo
New Member

I would like to display the time taken for a page to load in Splunk. Here is my query:

splunk_server=* index="myindex1" host=NA*P* host=COSERVER313 | convert num(time_taken) | sort 100 -time_taken

Here is the result:
splunk_server=* index="myindex1" host=NA*P* host=COSERVER313 | convert num(time_taken) | sort 100 -time_taken
2/28/19
1:59:28.000 AM

2019-02-28 06:59:28 W3SVC21 10.121.3.95 GET /en/mypage1/publications/documents/2016-documents/w112-document1.aspx - 443 - 10.121.3.101 Mozilla/5.0+(compatible;+search-crawler-EXTERNAL;++null;+SYS.COM.Search.Team@company.org) - 200 0 64 0 555 265525 54.88.115.238
host = COSERVER313 source = E:\ywlogs\company\IIS\W3SVC21\u_ex190228_x.log sourcetype = iis
2/28/19

Tags (1)
0 Karma

renjith_nair
Legend

@jdhavo,
Where is the problem now ? Are you not getting time_taken value? is that a field?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...