Splunk Search

Get the values of response_time from the below raw data

Bala
Explorer

i Want to get the value of 200 as status code and response_time in a table format from the below raw data

StatusResponse_Time
2000.012052
2000.103866
  

 

Log1 :

 \"GET /actuator HTTP/2.0\200 0 1851 \"-\\"Mozilla/5.0 (WindowsNT 10.0Win64x64AppleWebKit/537.36 (KHTMLlike GeckoChrome/97.0.4692.71Safari/537.36 Edg/97.0.1072.55\\"10.229.62.179:56886\\"10.55.6.79:61026\x_forwarded_for:\"10.229.62.179\x_forwarded_proto:\"https\vcap_request_id:\"36c0662d-09e7-467f-774b-391ca2ad337a\response_time:0.012052gorouter_time:0.000224

Log 2:

HTTP/2.0\" 200 0 180 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\" \"10.229.62.179:54696\" \"10.55.6.79:61026\" x_forwarded_for:\"10.229.62.179\" x_forwarded_proto:\"https\" vcap_request_id:\"8b37b42c-f3b2-4103-5ac2-fb12009cad3f\" response_time:0.103866 gorouter_time:0.000265

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "HTTP/2.0\\\\\" (?<status>\d+).+response_time:(?<response_time>[0-9\.]+)"
| table status response_time

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "HTTP/2.0\\\\\" (?<status>\d+).+response_time:(?<response_time>[0-9\.]+)"
| table status response_time
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...