Splunk Search

How to group multiple methods responsetime into intervals and obtain count?

Splunk_321
Path Finder

Hi All,

I have a requirement where I need to group count of methods responsetime into different time intervals.

Below is what I tried 

basesearch 
| eval ResponseTime=if(uri=="/api/auth",null(),responsetime*1000) 
| rex field=gwrequesturi "(?<prefix>\S+)/locations/(?<method>\w+[^/?])" 
| table ResponseTime method

This is resulted in below output

ResponseTimeMethod
330A
1627B
1025B
3126A
2034B
.........................................

I have two possibilities for method (Say for ex: A and B)

I want to get results something like below (Responsetime and count of each method falling in that interval)

ResponseTimeAB
<=100048
>1000 and <=30001125
>3000 and <=50003523
>500024

 

Can someone help me with the query! 

Thanks in advance!

Labels (2)
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

@Splunk_321 - try below search:

basesearch 
| eval ResponseTime=if(uri=="/api/auth",null(),responsetime*1000) 
| rex field=gwrequesturi "(?<prefix>\S+)/locations/(?<method>\w+[^/?])" 
| table ResponseTime method

| eval category=case(ResponseTime<=1000,"<=1000", ResponseTime<=3000,">1000 and <=3000", ResponseTime<=5000,">3000 and <=5000", ResponseTime>5000,">5000")
| chart count over category by Method

 

 I hope this helps!!! Kindly upvote if it does!!!

View solution in original post

VatsalJagani
SplunkTrust
SplunkTrust

@Splunk_321 - try below search:

basesearch 
| eval ResponseTime=if(uri=="/api/auth",null(),responsetime*1000) 
| rex field=gwrequesturi "(?<prefix>\S+)/locations/(?<method>\w+[^/?])" 
| table ResponseTime method

| eval category=case(ResponseTime<=1000,"<=1000", ResponseTime<=3000,">1000 and <=3000", ResponseTime<=5000,">3000 and <=5000", ResponseTime>5000,">5000")
| chart count over category by Method

 

 I hope this helps!!! Kindly upvote if it does!!!

Splunk_321
Path Finder

This helps. Thank you for the solution!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...