Splunk alret

[saidAb]

Hello everyone,

I am looking for a Splunk search query to get the duration time of three sequential response code 200. It is not about average time or duration of one message but if three Success message responses taken totally more than 10 seconds.

Thanks in advance.

[saidAb]

At this moment, all message responses come in less that 10 seconds. This okay.

We want to create an alert, that  if eg, next happens:

Time                                                                   message repose code

15:00:43                                                                              200

15:00:45                                                                              200

15:00:54                                                                              200

or

Time                                                                   message repose code

15:00:43                                                                              200

15:00:55                                                                              200

15:00:56                                                                              200

So if 3 responses code 200 come with no error response between, and totally, they take more than 10 seconds.

[ITWhisperer]

Try it this way

| eval successtime=if(status=200,_time,null())
| streamstats range(successtime) as successrange count(successtime) as successcount window=3 by status reset_on_change=t
| where successcount=3 and successrange > 10

[saidAb]

This gives almost the same result, time of succses events. This is useful for the future. For now I wait with this query, because it seems we need a field 'Duration' in message to check the performances of response call

[saidAb]

I mean three consecutive respaces 2000.

[ITWhisperer]

Did you mean that the response codes are all 200 but take more than 10 seconds?

If so, what do you want to do if there are non-200 responses?

Please clarify your requirement

[saidAb]

I have another alert for non-200 response codes. For this one I want to see if three consecutive 200 responses, take more than 10 seconds totally. That means I will create an alert about this.

[ITWhisperer]

This is what my solution does - how does it not do what you expect? Please provide examples

[ITWhisperer]

Try something like this

| eval successtime=if(status=200,_time,null())
| streamstats range(successtime) as successrange count(successtime) as successcount window=3 by status global=f
| where successcount=3 and successrange > 10

[saidAb]

Thanks! This query gives some answer.  However, I still have to find the one with this situation:
I have another alert for non-200 response codes. For this one I want to see if three consecutive 200 responses, take more than 10 seconds totally. That means I will create an alert about this. So the query should result only this three consecutive 200 responses that together take more that 10 seconds.