Splunk Search

how to find out average response time for all events by looking at two fields in same event msg ?

splunkDevendra
Explorer


I've JSON Object in msg field as :

"objectA":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

I want to find out Average Total time taken by Successful responses i.e. in above example second attempts response time should be considered as it's success and not first attempts response time.
Total time taken = response time - requestTime;

so how to find out :
1. Average Response of All successful events found
2. Table with count for response time less than 1sec, between 1 sec to 2 sec, between 2sec to 3 sec, greater than 3 sec

Can you please help with Query ?

Thank you so much for your help and efforts.

Labels (5)
0 Karma

splunkDevendra
Explorer

Sample Data : 

"objectA":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

 


"objectB":{
"aggrStatus":"FAILURE",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
}
]
}


"objectC":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

 


"objectD":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
]
}


Let's assume Object A to D are results of search. and in my case, Only Object A and C should be considered for calculation as they are success and object B and D are failure. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?s)\"object\w\":(?<object>.*)"
| spath input=object path=attempts{} output=attempts
| mvexpand attempts
| spath input=attempts path=responses{} output=responses
| spath input=responses
| where status="SUCCESS"
| eval response=floor((responseTime-requestTime)/1000)
| stats count by response
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...