Splunk Search

how to convert bytes to second in report.

Aps17
Explorer

Hello. I'm buliding a report where i want byte to be converted into seconds/millisecond.
any idea how to do that
 source="/usr/IBM/HTTPServer/logs/access*" httpmethod="GET" statuscode="200" 
|eval APFields=split(loaninfo,"/")

|chart count(DDMURLLast),avg(DDMTimeTakenSeonds) max(DDMTimeTakenSeonds) stdev(DDMTimeTakenSeonds) by APfields

Labels (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Aps17,

as you can think, convert bytes in seconds isn't possible because they are two different physical quantities with different measure units.

If you have an average of your throughput it could be possible to execute an extrapolation from your data, but anyway it isn't possible that a response time is expressed in bytes!

So if you have the average of you throughput you can (using evel) calculate the averge time needed to send your bytes.

Ciao.

Giuseppe

View solution in original post

Aps17
Explorer

I am looking to retrieve the user response time for one of the application but here response time is in bytes then how can i get it converted to time format.

host=jtcstcxbsswb* source="/usr/IBM/HTTPServer/logs/access*" httpmethod="GET" statuscode="200" loaninfo="/api*" OR Requestinfo="*/" OR sitename="*/LoginAccountUserName"
|eval APFields=split(loaninfo,"/")
|eval APNumOfFields=mvcount(APFields)
|eval AP2ndFromLast=mvindex(APFields,APNumOfFields-2)
|eval APLoanNumber=mvindex(APFields,6)
|eval APLast=mvindex(APFields,-1)
|eval MB=round(((bytes/1024)/1024),2)
|bin _time |stats count(APLast), sum(MB) as URT, max(MB) as MaxURT by APLast,_time

 

this is my query.

gcusello
SplunkTrust
SplunkTrust

Hi @Aps17,

as you can think, convert bytes in seconds isn't possible because they are two different physical quantities with different measure units.

If you have an average of your throughput it could be possible to execute an extrapolation from your data, but anyway it isn't possible that a response time is expressed in bytes!

So if you have the average of you throughput you can (using evel) calculate the averge time needed to send your bytes.

Ciao.

Giuseppe

Aps17
Explorer

Understood.I found the response time in event field.

thank you gscusello.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Bytes is a measure of data, how does that equate to a measure of time? Or are you saying that the field you are calling bytes is actually a measure of time - is that in seconds, milliseconds, or what?

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear (to me) what is it that you want to "convert". Please can you explain further and/or give examples of what you would like to see

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...