Splunk Search

Get the values of response_time from the below raw data

Bala
Explorer

i Want to get the value of 200 as status code and response_time in a table format from the below raw data

StatusResponse_Time
2000.012052
2000.103866
  

 

Log1 :

 \"GET /actuator HTTP/2.0\200 0 1851 \"-\\"Mozilla/5.0 (WindowsNT 10.0Win64x64AppleWebKit/537.36 (KHTMLlike GeckoChrome/97.0.4692.71Safari/537.36 Edg/97.0.1072.55\\"10.229.62.179:56886\\"10.55.6.79:61026\x_forwarded_for:\"10.229.62.179\x_forwarded_proto:\"https\vcap_request_id:\"36c0662d-09e7-467f-774b-391ca2ad337a\response_time:0.012052gorouter_time:0.000224

Log 2:

HTTP/2.0\" 200 0 180 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36\" \"10.229.62.179:54696\" \"10.55.6.79:61026\" x_forwarded_for:\"10.229.62.179\" x_forwarded_proto:\"https\" vcap_request_id:\"8b37b42c-f3b2-4103-5ac2-fb12009cad3f\" response_time:0.103866 gorouter_time:0.000265

 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "HTTP/2.0\\\\\" (?<status>\d+).+response_time:(?<response_time>[0-9\.]+)"
| table status response_time

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "HTTP/2.0\\\\\" (?<status>\d+).+response_time:(?<response_time>[0-9\.]+)"
| table status response_time
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...