How to filter by time

[ycherbi]

Hi,

I am using Splunk to monitor our REST API calls

search is

index=prod-* "WEBSERVICES CALL ENDED"

it gives  me results, but I want to get only results when time> 5000 ms 

or get the slowest API response time by time field?

hoe can I do it?

[richgalloway]

We need more information. Please share some same (anonymized) data.

[ycherbi]

Hi,

Thank you for your reply,I will add more info

so this is my search

 index=prod-* "WEBSERVICES CALL ENDED"

It will return records that indicate about my API call end  (see image below)

As you can see we have processing time field in our logs and also time field (by Splunk) both are equal, I would to use this time field and get only API calls that processing time is longer than 5000ms ( add alerts).

Or get average API time, hope it more clear now

[to4kawa]

index=prod-* "WEBSERVICES CALL ENDED"

|rex field=time "(<time>\d+)"

|where time>5000

fire alert: event count > 0

[ycherbi]

Hi,

It didn't work got this error:

Error in 'rex' command: The regex '(<time>\d+)' does not extract anything. It should specify at least one named group. Format: (?<name>...).

The search job has failed due to an error. You may be able view the job in....

I tried also but no results

index=prod-* "WEBSERVICES CALL ENDED"

|rex field=time "processing time:<(?<time>.*)> ms"

|where time>10

[ycherbi]

Also this didnt work

index=prod-* "WEBSERVICES CALL ENDED"

|rex field=time "(?<time>.*)"

|where time>23

[ycherbi · Accepted solution]

found it

index=prod-* "WEBSERVICES CALL ENDED" 

|rex field=time "(?<time>\d+)"

|where time>1000

[to4kawa]

good job. please accept your answer. and I'm sorry for typo.