Splunk Search
Highlighted

How to filter by time

Explorer

Hi,

 

I am using Splunk to monitor our REST API calls

search is

index=prod-* "WEBSERVICES CALL ENDED"

it gives  me results, but I want to get only results when time> 5000 ms 

or get the slowest API response time by time field?

hoe can I do it?

Labels (1)
0 Karma
Highlighted

Re: How to filter by time

SplunkTrust
SplunkTrust
We need more information. Please share some same (anonymized) data.
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to filter by time

Explorer

Hi,

Thank you for your reply,I will add more info

so this is my search

 index=prod-* "WEBSERVICES CALL ENDED"

It will return records that indicate about my API call end  (see image below)

As you can see we have processing time field in our logs and also time field (by Splunk) both are equal, I would to use this time field and get only API calls that processing time is longer than 5000ms ( add alerts).

Or get average API time, hope it more clear now

 

 

0 Karma
Highlighted

Re: How to filter by time

Ultra Champion

index=prod-* "WEBSERVICES CALL ENDED"

|rex field=time "(<time>\d+)"

|where time>5000

 

fire alert: event count > 0

0 Karma
Highlighted

Re: How to filter by time

Explorer

Hi,

It didn't work got this error:

Error in 'rex' command: The regex '(<time>\d+)' does not extract anything. It should specify at least one named group. Format: (?<name>...).
The search job has failed due to an error. You may be able view the job in....

 

I tried also but no results

index=prod-* "WEBSERVICES CALL ENDED"

|rex field=time "processing time:<(?<time>.*)> ms"

|where time>10

Tags (1)
0 Karma
Highlighted

Re: How to filter by time

Explorer

Also this didnt work

 

index=prod-* "WEBSERVICES CALL ENDED"

|rex field=time "(?<time>.*)"

|where time>23

0 Karma
Highlighted

Re: How to filter by time

Explorer

found it

 

index=prod-* "WEBSERVICES CALL ENDED" 

|rex field=time "(?<time>\d+)"

|where time>1000

View solution in original post

0 Karma
Highlighted

Re: How to filter by time

Ultra Champion

good job. please accept your answer. and I'm sorry for typo.

0 Karma