Splunk Search

How do convert a field and report on the average response time?

Brian_Osburn
Builder

I have a field in my Apache logs that's defined as "MicroSeconds". This is the response time in microseconds for a specific call in Apache to our Weblogic back ends.

I'm trying to generate a real time chart on the average response times based on the "Microseconds" field. I'd like to be able to convert microseconds to milliseconds so I don't freak out our users when they see a transaction hit 4000..

How would I do that? The basic search right now is:

index="uat_apache_logs" /pbng | timechart avg(MicroSeconds) 

which works good..I just need to convert it to milliseconds..

Thanks in advance.

0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

You can use the "eval" command to perform operations in field values: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval

In your case:

... | timechart avg(MicroSeconds) as avgus | eval avg_milliseconds = avgus/1000

View solution in original post

ebailey
Communicator

How did you define the field in Splunk? I assume you are using the Apache response time option in the log format?

Thanks

Ed

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You can use the "eval" command to perform operations in field values: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval

In your case:

... | timechart avg(MicroSeconds) as avgus | eval avg_milliseconds = avgus/1000

sideview
SplunkTrust
SplunkTrust

Answer is disarmingly simple - just do the eval before the timechart instead of after. "eval milliseconds=MicroSeconds*1000 | timechart avg(milliseconds)"

Brian_Osburn
Builder

That works. Anyway to make drilldown work with this? I get a "# PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command"

Brian

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...