Hi,
I am using Splunk to monitor our REST API calls
search is
index=prod-* "WEBSERVICES CALL ENDED"
it gives me results, but I want to get only results when time> 5000 ms
or get the slowest API response time by time field?
hoe can I do it?
found it
index=prod-* "WEBSERVICES CALL ENDED"
|rex field=time "(?<time>\d+)"
|where time>1000
Hi,
Thank you for your reply,I will add more info
so this is my search
index=prod-* "WEBSERVICES CALL ENDED"
It will return records that indicate about my API call end (see image below)
As you can see we have processing time field in our logs and also time field (by Splunk) both are equal, I would to use this time field and get only API calls that processing time is longer than 5000ms ( add alerts).
Or get average API time, hope it more clear now
index=prod-* "WEBSERVICES CALL ENDED"
|rex field=time "(<time>\d+)"
|where time>5000
fire alert: event count > 0
Hi,
It didn't work got this error:
I tried also but no results
index=prod-* "WEBSERVICES CALL ENDED"
|rex field=time "processing time:<(?<time>.*)> ms"
|where time>10
Also this didnt work
index=prod-* "WEBSERVICES CALL ENDED"
|rex field=time "(?<time>.*)"
|where time>23
found it
index=prod-* "WEBSERVICES CALL ENDED"
|rex field=time "(?<time>\d+)"
|where time>1000
good job. please accept your answer. and I'm sorry for typo.