Splunk Search

how to find out average response time for all events by looking at two fields in same event msg ?

splunkDevendra
Explorer


I've JSON Object in msg field as :

"objectA":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

I want to find out Average Total time taken by Successful responses i.e. in above example second attempts response time should be considered as it's success and not first attempts response time.
Total time taken = response time - requestTime;

so how to find out :
1. Average Response of All successful events found
2. Table with count for response time less than 1sec, between 1 sec to 2 sec, between 2sec to 3 sec, greater than 3 sec

Can you please help with Query ?

Thank you so much for your help and efforts.

Labels (5)
0 Karma

splunkDevendra
Explorer

Sample Data : 

"objectA":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

 


"objectB":{
"aggrStatus":"FAILURE",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
}
]
}


"objectC":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

 


"objectD":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
]
}


Let's assume Object A to D are results of search. and in my case, Only Object A and C should be considered for calculation as they are success and object B and D are failure. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?s)\"object\w\":(?<object>.*)"
| spath input=object path=attempts{} output=attempts
| mvexpand attempts
| spath input=attempts path=responses{} output=responses
| spath input=responses
| where status="SUCCESS"
| eval response=floor((responseTime-requestTime)/1000)
| stats count by response
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...