Splunk Search

Response time

Als123
Explorer

Hi Team,

I am having a question regarding log details in Splunk.

1.How response time is generating in logs.?

2.From where it gets configured?

Labels (1)
0 Karma

Als123
Explorer

@gcusello ,

Thank you. Got it now.

0 Karma

gcusello
Esteemed Legend

HI @Als123,

what do you mean with "response time"?

in Splunk there are two timestamps:

  • _time: the timestamp of the event, extracted during indexing from the event with rules defined in props.conf,
  • _indextime: the timestamp associated to the event when the event is indexed by Splunk.

If instead you're speaking of a field in event (e.g. milliseconds from a web transactions) you have to extract it using a regex.

Ciao.

Giuseppe

Als123
Explorer

Hi @gcusello ,

In my logs, I couldn't able to see the response time of the transaction.How to get that one?Can you please help me?

0 Karma

gcusello
Esteemed Legend

Hi @Als123,

this is a very generic question!

Anyway, if you can clearly identify your transactions (e.g. using a unique Transaction ID to group all the events of a transaction) you can use more solutions to calculate the duration of the transaction.

The easiest way, but not the more performant is the transaction command (see to https://docs.splunk.com/Documentation/Splunk/8.1.3/SearchReference/Transaction ).

Otherway you can use the stats command, that's faster than the other, try somerhng like this:

Your_search
| stats earliest(_time) AS earliest latest(_time) AS latest BY transaction_ID
| eval duration=latest-earliest
| table transaction_ID duration

 Ciao.

Giuseppe

0 Karma

Als123
Explorer

Hi @gcusello ,

Thank you.

0 Karma

gcusello
Esteemed Legend

HI @Als123,

if this answer solves your need, please accept it for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...