How to get the list of all APIs with the response time more than 30sec in splunk

[splunk6]

Hi All,

I have a soap request and response being ingested in the splunk under an index. There are multiple API calls available under the particular index="wireless_retail". How to get the list of all API calls under this index which consume RESPONSETIME > 30sec. My sample soap request and response in splunk is :

<getOrderServiceResponse xmlns=> <Case>90476491</Case> <SalesOrderId>8811662</SalesOrderId> <CustType>GW CONSUMER</CustType> <CustNodeId>4000593888</CustNodeId>  <AccountId>4001293845</AccountId> <ServiceName>4372551943</ServiceName> <ServiceId>4000996500</ServiceId> <BillCyclePeriod>11/07/2023 - 06/19/2024</BillCyclePeriod> <NextBillDueDate>06/03/2024</NextBillDueDate> <TabAcctBalance/> <DeviceUnitPrice>0.00</DeviceUnitPrice> <DepositAcctBalance/> <tabAmount>0.00</tabAmount> <tabMonthlyFee>0.00</tabMonthlyFee> <tabDepletionRate>0.00</tabDepletionRate> <deviceOutrightCost>0.00</deviceOutrightCost> <deviceOutrightPayment>0.00</deviceOutrightPayment> <ConnectionFeeDetails> <connectionFee>45.00</connectionFee> <connectionFeePromoCode>CF9 Connection Fee Promo</connectionFeePromoCode> <connectionFeePromoValue>45.00</connectionFeePromoValue> <netConnectionFee>0.00</netConnectionFee> </ConnectionFeeDetails> </getOrderServiceResponse> </soapenv:Body> </soapenv:Envelope>", RETRYNO="0",, OPERATION="getOrderService", METHOD="SOAP", CONNECTORID="48169c3e-9d28-4b8f-9b9f-14ca83299cca", CONNECTORNAME="SingleView", CONNECTORTYPE="Application", CONNECTORSUBTYPE="SOAP", STARTTIME="1715367648945", ENDTIME="1715367688620", RESPONSETIME="39675",

So my sample API req is getOrderServiceResponse and getOrderServiceRequest. Like this there are multiple API calls available in the index. I want all the API calls along with the RESPONSETIME in a graph format to know which is consuming more than 30seconds. COuuld you please help?

[PickleRick]

OK. And what is your problem here? You've shown us some data sample (not in entirety though - it seems it's cut after a comma and we can't know if it's - for example - a well formed XML) but we don't know what have you tried so far and what isn't working the way you'd expect.

Do you have problems extracting fields? Or searching for matching data? Aggregating? Visualizing?