Splunk Search

How do I get the average response times for all services without specifying each service name in a search?

chanukhya
Explorer

I am trying to get average response times of all services (services1.. service n). I am able to get average response time by using the following search.

index = app1 "service1"|timechart avg(processTime)

Here is my log format.

0000037f SystemOut     O {"serviceName":"service 1"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}

0000037f SystemOut     O {"serviceName":"service 6"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}

How can i get the average response times for all the services (service1..service n).., without mentioning the service name in the search string?

0 Karma
1 Solution

sundareshr
Legend

Try this

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm

OR

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm

View solution in original post

sundareshr
Legend

Try this

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm

OR

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm

richgalloway
SplunkTrust
SplunkTrust

Perhaps index = app1 "service*"|timechart avg(processTime)?

---
If this reply helps you, Karma would be appreciated.
0 Karma

chanukhya
Explorer

This doesn't display the service name. I would like to have the service name and avg response times together.

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...