Splunk Search

How do I get the average response times for all services without specifying each service name in a search?

chanukhya
Explorer

I am trying to get average response times of all services (services1.. service n). I am able to get average response time by using the following search.

index = app1 "service1"|timechart avg(processTime)

Here is my log format.

0000037f SystemOut     O {"serviceName":"service 1"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}

0000037f SystemOut     O {"serviceName":"service 6"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}

How can i get the average response times for all the services (service1..service n).., without mentioning the service name in the search string?

0 Karma
1 Solution

sundareshr
Legend

Try this

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm

OR

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm

View solution in original post

sundareshr
Legend

Try this

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm

OR

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm

richgalloway
SplunkTrust
SplunkTrust

Perhaps index = app1 "service*"|timechart avg(processTime)?

---
If this reply helps you, Karma would be appreciated.
0 Karma

chanukhya
Explorer

This doesn't display the service name. I would like to have the service name and avg response times together.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...