Splunk Search

Query execution time

benji00
New Member

Hello,

When searching through Splunk the following request:
index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY
I am receiving events as written below:
2019-03-12 08:32:40.629 | [http-nio-8094-exec-4] | DEBUG | c.d.federated_search.utils.Log | | | | [577] ##### [TIMER][CVServlet][COMPLETE_QUERY][113][ms] #####
2019-03-12 08:27:09.782 | [http-nio-8094-exec-6] | DEBUG | c.d.federated_search.utils.Log | | | | [444] ##### [TIMER][CVServlet][COMPLETE_QUERY][118][ms] #####

My final objective is to have a timechart of the COMPLET_QUERY execution time in ms with the content of the next [] after the [COMPLETE_QUERY] one.
Any idea? How to know if the log is a known format?
I am currently trying by extracting new fields and using delimiters...

Tags (1)
0 Karma
1 Solution

nickhills
Ultra Champion

Hi @benji00

I'm not clear if you have already extracted the fields - if not that would be the best approach.

However, a quick and dirty way is to do the extraction inline:

index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY|rex "COMPLETE_QUERY\]\[(?P<response_time>\d+)"|timechart avg(response_time)
If my comment helps, please give it a thumbs up!

View solution in original post

0 Karma

benji00
New Member

Hello @nickhillscpl,
Thanks for you feedback.
Yes finally I used the extractong fields mode by using delimiters and it is working correctly. Not sure if it is the most efficient way but it is working.
Your way seems quite clean... why do you say it is a dirty way ?
Anyway I am going to accept your comment.

0 Karma

nickhills
Ultra Champion

Hi @benji00

I'm not clear if you have already extracted the fields - if not that would be the best approach.

However, a quick and dirty way is to do the extraction inline:

index=3dexperience host=io-ws-3de*pr COMPLETE_QUERY|rex "COMPLETE_QUERY\]\[(?P<response_time>\d+)"|timechart avg(response_time)
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...