Splunk Search

How to create a table on windowed count of api response time?

anonym3421
Engager

I have some api response logs separated by pipe. However there is already field extraction on api response time. the field value is something like "100 ms". I want to create a table on windowed count of api response time. 

The final table I want to create is some thing like

responseTime                     count

5 ms.                    {count where responseTime <= 5ms}

10 ms                    {count where responseTime <= 10ms but >5ms}

 

I can create a simple count table by " base search | stats count by responseTime" which results like

responseTime               count

1 ms                                    100

2 ms                                     30

 

How can I create this windowed stats?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming responseTime is already measured in milliseconds:

base search 
| bin responseTime span=5s
| stats count by responseTime

The s is important otherwise you get a range of values.

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming responseTime is already measured in milliseconds:

base search 
| bin responseTime span=5s
| stats count by responseTime

The s is important otherwise you get a range of values.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...