Splunk Search

how to convert bytes to second in report.

Aps17
Explorer

Hello. I'm buliding a report where i want byte to be converted into seconds/millisecond.
any idea how to do that
 source="/usr/IBM/HTTPServer/logs/access*" httpmethod="GET" statuscode="200" 
|eval APFields=split(loaninfo,"/")

|chart count(DDMURLLast),avg(DDMTimeTakenSeonds) max(DDMTimeTakenSeonds) stdev(DDMTimeTakenSeonds) by APfields

Labels (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Aps17,

as you can think, convert bytes in seconds isn't possible because they are two different physical quantities with different measure units.

If you have an average of your throughput it could be possible to execute an extrapolation from your data, but anyway it isn't possible that a response time is expressed in bytes!

So if you have the average of you throughput you can (using evel) calculate the averge time needed to send your bytes.

Ciao.

Giuseppe

View solution in original post

Aps17
Explorer

I am looking to retrieve the user response time for one of the application but here response time is in bytes then how can i get it converted to time format.

host=jtcstcxbsswb* source="/usr/IBM/HTTPServer/logs/access*" httpmethod="GET" statuscode="200" loaninfo="/api*" OR Requestinfo="*/" OR sitename="*/LoginAccountUserName"
|eval APFields=split(loaninfo,"/")
|eval APNumOfFields=mvcount(APFields)
|eval AP2ndFromLast=mvindex(APFields,APNumOfFields-2)
|eval APLoanNumber=mvindex(APFields,6)
|eval APLast=mvindex(APFields,-1)
|eval MB=round(((bytes/1024)/1024),2)
|bin _time |stats count(APLast), sum(MB) as URT, max(MB) as MaxURT by APLast,_time

 

this is my query.

gcusello
SplunkTrust
SplunkTrust

Hi @Aps17,

as you can think, convert bytes in seconds isn't possible because they are two different physical quantities with different measure units.

If you have an average of your throughput it could be possible to execute an extrapolation from your data, but anyway it isn't possible that a response time is expressed in bytes!

So if you have the average of you throughput you can (using evel) calculate the averge time needed to send your bytes.

Ciao.

Giuseppe

Aps17
Explorer

Understood.I found the response time in event field.

thank you gscusello.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Bytes is a measure of data, how does that equate to a measure of time? Or are you saying that the field you are calling bytes is actually a measure of time - is that in seconds, milliseconds, or what?

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear (to me) what is it that you want to "convert". Please can you explain further and/or give examples of what you would like to see

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...