Splunk Search

How to create a Splunk search to find response time for API Calls?

mintally
New Member

I want to calculate response time from my logs for all records and our application logs in below format,
Can you please provide query for this?

[2019-04-15 16:49:32.295 GMT][INFO ] [{txnId=wcf_98Y64BaiB3}][Info] - stage : Create Relationship started
[2019-04-15 16:49:32.314 GMT][INFO ] [{txnId=wcf_98Y64BaiB3}][Info] - stage : Create started
[2019-04-15 16:49:32.333 GMT][INFO ] [{txnId=wcf_98Y64BaiB3}][Info] - stage : The status of managed account = PENDING
[2019-04-15 16:49:32.602 GMT][INFO ] [{txnId=wcf_98Y64BaiB3}][Info] - stage : Create Relationship competed
[2019-04-15 16:49:32.602 GMT][INFO ] [{txnId=wcf_98Y64BaiB3}][Info] - stage : Create Relationship call executed

0 Karma

somesoni2
Revered Legend

Give this method a try (transaction command can be easy to implement but is awfully resource expensive)

index=foo sourcetype=bar ( Create Relationship started ) OR ( Create Relationship call executed )
| stats min(_time) as startedOn max(_time) as endedOn by txnId
| eval response_time=endedOn-startedOn
| convert ctime(*On) as *On 
0 Karma

grittonc
Contributor

Have you tried transaction? Try adding | transaction startswith="Create Relationship started" endswith="Create Relationship call executed" to your search. There will be a field called duration that will tell you how much time elapsed.

Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...