Splunk Search

How do I get the average response times for all services without specifying each service name in a search?

chanukhya
Explorer

I am trying to get average response times of all services (services1.. service n). I am able to get average response time by using the following search.

index = app1 "service1"|timechart avg(processTime)

Here is my log format.

0000037f SystemOut     O {"serviceName":"service 1"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}

0000037f SystemOut     O {"serviceName":"service 6"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}

How can i get the average response times for all the services (service1..service n).., without mentioning the service name in the search string?

0 Karma
1 Solution

sundareshr
Legend

Try this

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm

OR

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm

View solution in original post

sundareshr
Legend

Try this

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm

OR

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm

richgalloway
SplunkTrust
SplunkTrust

Perhaps index = app1 "service*"|timechart avg(processTime)?

---
If this reply helps you, Karma would be appreciated.
0 Karma

chanukhya
Explorer

This doesn't display the service name. I would like to have the service name and avg response times together.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...