Splunk Search

how to convert bytes to second in report.

Aps17
Explorer

Hello. I'm buliding a report where i want byte to be converted into seconds/millisecond.
any idea how to do that
 source="/usr/IBM/HTTPServer/logs/access*" httpmethod="GET" statuscode="200" 
|eval APFields=split(loaninfo,"/")

|chart count(DDMURLLast),avg(DDMTimeTakenSeonds) max(DDMTimeTakenSeonds) stdev(DDMTimeTakenSeonds) by APfields

Labels (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Aps17,

as you can think, convert bytes in seconds isn't possible because they are two different physical quantities with different measure units.

If you have an average of your throughput it could be possible to execute an extrapolation from your data, but anyway it isn't possible that a response time is expressed in bytes!

So if you have the average of you throughput you can (using evel) calculate the averge time needed to send your bytes.

Ciao.

Giuseppe

View solution in original post

Aps17
Explorer

I am looking to retrieve the user response time for one of the application but here response time is in bytes then how can i get it converted to time format.

host=jtcstcxbsswb* source="/usr/IBM/HTTPServer/logs/access*" httpmethod="GET" statuscode="200" loaninfo="/api*" OR Requestinfo="*/" OR sitename="*/LoginAccountUserName"
|eval APFields=split(loaninfo,"/")
|eval APNumOfFields=mvcount(APFields)
|eval AP2ndFromLast=mvindex(APFields,APNumOfFields-2)
|eval APLoanNumber=mvindex(APFields,6)
|eval APLast=mvindex(APFields,-1)
|eval MB=round(((bytes/1024)/1024),2)
|bin _time |stats count(APLast), sum(MB) as URT, max(MB) as MaxURT by APLast,_time

 

this is my query.

gcusello
SplunkTrust
SplunkTrust

Hi @Aps17,

as you can think, convert bytes in seconds isn't possible because they are two different physical quantities with different measure units.

If you have an average of your throughput it could be possible to execute an extrapolation from your data, but anyway it isn't possible that a response time is expressed in bytes!

So if you have the average of you throughput you can (using evel) calculate the averge time needed to send your bytes.

Ciao.

Giuseppe

Aps17
Explorer

Understood.I found the response time in event field.

thank you gscusello.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Bytes is a measure of data, how does that equate to a measure of time? Or are you saying that the field you are calling bytes is actually a measure of time - is that in seconds, milliseconds, or what?

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear (to me) what is it that you want to "convert". Please can you explain further and/or give examples of what you would like to see

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...