Splunk Search

How do I get the average response times for all services without specifying each service name in a search?

chanukhya
Explorer

I am trying to get average response times of all services (services1.. service n). I am able to get average response time by using the following search.

index = app1 "service1"|timechart avg(processTime)

Here is my log format.

0000037f SystemOut     O {"serviceName":"service 1"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}

0000037f SystemOut     O {"serviceName":"service 6"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}

How can i get the average response times for all the services (service1..service n).., without mentioning the service name in the search string?

0 Karma
1 Solution

sundareshr
Legend

Try this

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm

OR

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm

View solution in original post

sundareshr
Legend

Try this

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm

OR

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm

richgalloway
SplunkTrust
SplunkTrust

Perhaps index = app1 "service*"|timechart avg(processTime)?

---
If this reply helps you, Karma would be appreciated.
0 Karma

chanukhya
Explorer

This doesn't display the service name. I would like to have the service name and avg response times together.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...