Duration, Average , max, min response Time

[BT]

2 events : request and response and unique id which binds this transaction.

I have  issue where i have to calculate the total duration between request and response and average , max and min response time from all the transaction triggered per day/per hour. the below query works in extracting request and response but duration is not being calculated, or displayed  when i run the query :

search query |  stats earliest(dateTime) AS request latest(dateTime) AS response BY TransactionID | eval duration=response- request 

result for above query :

TransactionID                                                                          Request                                              Response

000877d43ef8778123243454bda780c5e5     2022-05-05 01:36:12.916      2022-05-05 01:36:13.27

Please help in writing query for calculating duration and avg, max,min response time for all the transaction happened in a day

[ITWhisperer]

Given that the Request and Response times are shown as strings, I suspect you need to parse them into epoch times with strptime() before doing any calculation on the values.

[BT]

i am new to splunk, can you please provide the query to do so also to calculate duration = response-request , avg, max, min response time.

[ITWhisperer · Accepted solution]

Set the time frame for the search to be the day in question - this could be relative e.g. yesterday

search query
| eval dateTime=strptime(dateTime,"%F %T.%3N")
| stats earliest(dateTime) AS request latest(dateTime) AS response BY TransactionID 
| eval duration=response-request
| stats avg(duration) as average min(duration) as minimum max(duration) as maximum

Depending on what you already have in your events, you may find that the _time field already holds the dateTime in epoch format so this could be simplified to

search query
| stats earliest(_time) AS request latest(_time) AS response BY TransactionID 
| eval duration=response-request
| stats avg(duration) as average min(duration) as minimum max(duration) as maximum

There is a "hidden" problem with this whereby if the transaction "starts" on the previous day or finishes on the "next" day, you may find that the earliest event in the search for the TransactionID is the only event returned by the search and is therefore the same as the latest, so the duration by this calculation will be zero.

[BT]

Thank you.. This works !!!! just another doubt.. the result avg , max, min are in seconds or miliseconds ?

[ITWhisperer]

Seconds - epoch times are in seconds although they can have decimal places for sub-second values