Splunk Search

From the following log data, how do I create a table that includes the average response time?

New Member

My log Data is in this format:

response="{"status":"success","Registries":[{"create":"2018-08-28","last":null,"Story":null}]}" response_Time="4"

When i try to create a table with response and response time, I get { for response and response time as blank

When i try to get the average of response time, i get nothing.

Can anyone help me with queries to get full JSON data in table and average response time.

0 Karma


Do you need average response time by a field in the events or average of all response times in entire data set ? because if you ultimately require table of raw data(json) and average response time then it should be by some field in your events.

You can do like this :

your base search | rex "response_Time\=\"(?<response_time>\d+)\"" | table _raw response_time | eventstats avg(response_time) as average

You can add any field after the by clause. Let me know if it works, i can help further.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...