Splunk Search

How to create a time chart on response times for multiple services?

New Member

I want to display the response time of 2 different transactions (or 2 events). Let's say, first transaction/event is combination of 2 rest services, and second transaction is a different service call. I can identify these all rest services using their service urls. Also, for the first transaction, response time will be considered as the sum of "average response time of each rest service response time".

0 Karma

SplunkTrust
SplunkTrust

Without your current query/details on how your data looks like, give this a try

your base search url=restservicecall1 OR url=restservicecall2 OR url=restservicecall3 | eval transaction=if(url="restservicecall3" ,"Transaction2","Transaction1") | timechart avg(response_time)  by transaction
0 Karma

Legend

Let's say your REST services are called svc1, svc2 & svc2. Try this

base search | bin span=1h _time | stats avg(eval(RESTURL="svc1") as svc1_avg avg(eval(RESTURL="svc2") as svc2_avg avg(eval(RESTURL="svc3") as resp_txn2 by _time | eval resp_txn1=svc1_avg+svc2_avg | table resp_txn1 resp_txn2
0 Karma

New Member

I tried it. It is giving error saying "Error in 'bin' command: Invalid argument: 'stats'"

0 Karma

Legend

Try updated answer.

0 Karma