Retrieve slow queries in splunk search

[pgadge]

Hi Guys,

I am very new to splunk and operating on thew following data. I want to retrieve SQL queries which take more than 4 secs. My data looks like this,

Time: 130114 18:25:24

User@Host: web-03-prod-01[web-03-prod-01] @ [10.2.2.88]

Query_time: 4.137378 Lock_time: 0.000114 Rows_sent: 248 Rows_examined: 1777155

How can I use > or < operator to retrieve data which has a Query_time value more than 4 secs.

[Ayn · Accepted solution]

First make sure you have the query time extracted as a field. See the following section in the docs: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addfieldsatsearchtime

Then you can just do

query_time>4

in your search.