Splunk Search

From the following log data, how do I create a table that includes the average response time?

New Member

My log Data is in this format:

response="{"status":"success","Registries":[{"create":"2018-08-28","last":null,"Story":null}]}" response_Time="4"

When i try to create a table with response and response time, I get { for response and response time as blank

When i try to get the average of response time, i get nothing.

Can anyone help me with queries to get full JSON data in table and average response time.

0 Karma


Do you need average response time by a field in the events or average of all response times in entire data set ? because if you ultimately require table of raw data(json) and average response time then it should be by some field in your events.

You can do like this :

your base search | rex "response_Time\=\"(?<response_time>\d+)\"" | table _raw response_time | eventstats avg(response_time) as average

You can add any field after the by clause. Let me know if it works, i can help further.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...