Splunk Search

Need help with a greater than in seconds

New Member

My search alert filter: host=web-* "\"response_code\": 5*," OR "\"message\": \"Application Error\"" OR "\"response_code\": 0"\"total_time\" userloans

QUESTION. I need to modify my alert so it captures all responses that has greater than total_time of 9 secs (below sample). What should I add to capture this to my alert above? Any help would be great!

E, [2017-02-11T03:09:33.426066 #58] ERROR -- : {
"url": "http://12345/A.v.x455.adfadfr.co/loans/userloans",
"method": "get",
"request_headers": {
"Content-Type": "application/json",
"client_ip": "[FILTERED]",
"request_body": null,
"response_code": 0,
"response_body": "",
"total_time": 9.0,
"starttransfer_time": 0.0,
"appconnect_time": 0.0,
"pretransfer_time": 0.0001,
"connect_time": 0.0,
"namelookup_time": 0.0,
"redirect_time": 0.0

Tags (1)
0 Karma


Hope this helps:

host=web- "\"response_code\": 5," OR "\"message\": \"Application Error\"" OR "\"response_code\": 0"\"total_time\" userloans
| rex field=_raw "\"total_time\":\s*(?<totalTime>[^,\s]+)"
| where totalTime > 9
0 Karma


If you don't have it already, you need to extract the total time into a field like below and filter on it

your base search | rex "(?i)\Wtotal_time\W{2}(?P<TOTAL_TIME>\.\S+)\," | where TOTAL_TIME > 9

The above rex might not be perfect, but you get the idea

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...