Splunk Search

How do convert a field and report on the average response time?

Builder

I have a field in my Apache logs that's defined as "MicroSeconds". This is the response time in microseconds for a specific call in Apache to our Weblogic back ends.

I'm trying to generate a real time chart on the average response times based on the "Microseconds" field. I'd like to be able to convert microseconds to milliseconds so I don't freak out our users when they see a transaction hit 4000..

How would I do that? The basic search right now is:

index="uat_apache_logs" /pbng | timechart avg(MicroSeconds) 

which works good..I just need to convert it to milliseconds..

Thanks in advance.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

You can use the "eval" command to perform operations in field values: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval

In your case:

... | timechart avg(MicroSeconds) as avgus | eval avg_milliseconds = avgus/1000

View solution in original post

Communicator

How did you define the field in Splunk? I assume you are using the Apache response time option in the log format?

Thanks

Ed

0 Karma

Splunk Employee
Splunk Employee

You can use the "eval" command to perform operations in field values: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval

In your case:

... | timechart avg(MicroSeconds) as avgus | eval avg_milliseconds = avgus/1000

View solution in original post

SplunkTrust
SplunkTrust

Answer is disarmingly simple - just do the eval before the timechart instead of after. "eval milliseconds=MicroSeconds*1000 | timechart avg(milliseconds)"

Builder

That works. Anyway to make drilldown work with this? I get a "# PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command"

Brian

0 Karma