Splunk Search

Query execution time

benji00
New Member

Hello,

When searching through Splunk the following request:
index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY
I am receiving events as written below:
2019-03-12 08:32:40.629 | [http-nio-8094-exec-4] | DEBUG | c.d.federated_search.utils.Log | | | | [577] ##### [TIMER][CVServlet][COMPLETE_QUERY][113][ms] #####
2019-03-12 08:27:09.782 | [http-nio-8094-exec-6] | DEBUG | c.d.federated_search.utils.Log | | | | [444] ##### [TIMER][CVServlet][COMPLETE_QUERY][118][ms] #####

My final objective is to have a timechart of the COMPLET_QUERY execution time in ms with the content of the next [] after the [COMPLETE_QUERY] one.
Any idea? How to know if the log is a known format?
I am currently trying by extracting new fields and using delimiters...

Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

Hi @benji00

I'm not clear if you have already extracted the fields - if not that would be the best approach.

However, a quick and dirty way is to do the extraction inline:

index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY|rex "COMPLETE_QUERY\]\[(?P<response_time>\d+)"|timechart avg(response_time)
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

benji00
New Member

Hello @nickhillscpl,
Thanks for you feedback.
Yes finally I used the extractong fields mode by using delimiters and it is working correctly. Not sure if it is the most efficient way but it is working.
Your way seems quite clean... why do you say it is a dirty way ?
Anyway I am going to accept your comment.

0 Karma

nickhills
Ultra Champion

Hi @benji00

I'm not clear if you have already extracted the fields - if not that would be the best approach.

However, a quick and dirty way is to do the extraction inline:

index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY|rex "COMPLETE_QUERY\]\[(?P<response_time>\d+)"|timechart avg(response_time)
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...