Splunk Search

Query execution time

benji00
New Member

Hello,

When searching through Splunk the following request:
index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY
I am receiving events as written below:
2019-03-12 08:32:40.629 | [http-nio-8094-exec-4] | DEBUG | c.d.federated_search.utils.Log | | | | [577] ##### [TIMER][CVServlet][COMPLETE_QUERY][113][ms] #####
2019-03-12 08:27:09.782 | [http-nio-8094-exec-6] | DEBUG | c.d.federated_search.utils.Log | | | | [444] ##### [TIMER][CVServlet][COMPLETE_QUERY][118][ms] #####

My final objective is to have a timechart of the COMPLET_QUERY execution time in ms with the content of the next [] after the [COMPLETE_QUERY] one.
Any idea? How to know if the log is a known format?
I am currently trying by extracting new fields and using delimiters...

Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

Hi @benji00

I'm not clear if you have already extracted the fields - if not that would be the best approach.

However, a quick and dirty way is to do the extraction inline:

index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY|rex "COMPLETE_QUERY\]\[(?P<response_time>\d+)"|timechart avg(response_time)
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

benji00
New Member

Hello @nickhillscpl,
Thanks for you feedback.
Yes finally I used the extractong fields mode by using delimiters and it is working correctly. Not sure if it is the most efficient way but it is working.
Your way seems quite clean... why do you say it is a dirty way ?
Anyway I am going to accept your comment.

0 Karma

nickhills
Ultra Champion

Hi @benji00

I'm not clear if you have already extracted the fields - if not that would be the best approach.

However, a quick and dirty way is to do the extraction inline:

index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY|rex "COMPLETE_QUERY\]\[(?P<response_time>\d+)"|timechart avg(response_time)
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...