Splunk Search

Get the values of response_time from the below raw data

Bala
Explorer

i Want to get the value of 200 as status code and response_time in a table format from the below raw data

StatusResponse_Time
2000.012052
2000.103866
  

 

Log1 :

 \"GET /actuator HTTP/2.0\200 0 1851 \"-\\"Mozilla/5.0 (WindowsNT 10.0Win64x64AppleWebKit/537.36 (KHTMLlike GeckoChrome/97.0.4692.71Safari/537.36 Edg/97.0.1072.55\\"10.229.62.179:56886\\"10.55.6.79:61026\x_forwarded_for:\"10.229.62.179\x_forwarded_proto:\"https\vcap_request_id:\"36c0662d-09e7-467f-774b-391ca2ad337a\response_time:0.012052gorouter_time:0.000224

Log 2:

HTTP/2.0\" 200 0 180 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\" \"10.229.62.179:54696\" \"10.55.6.79:61026\" x_forwarded_for:\"10.229.62.179\" x_forwarded_proto:\"https\" vcap_request_id:\"8b37b42c-f3b2-4103-5ac2-fb12009cad3f\" response_time:0.103866 gorouter_time:0.000265

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "HTTP/2.0\\\\\" (?<status>\d+).+response_time:(?<response_time>[0-9\.]+)"
| table status response_time

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "HTTP/2.0\\\\\" (?<status>\d+).+response_time:(?<response_time>[0-9\.]+)"
| table status response_time
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...

.conf23 Registration is Now Open!

Time to toss the .conf-etti &#x1f389; —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...