Splunk Search

timechart call Time

area34
New Member

Hi,

I tried to made a timechart (call duration) , the value I onyl have is the Users and the methods and the call timestamp. I want see how long the call takes with the user again one method?

thats my datas

timestamp user method

2020-04-15 07:18:28.978 WSABXXX checkXXXX

0 Karma

to4kawa
Ultra Champion
index=yours
| eval timestamp=strptime(timestamp,"%F %T.%3Q")
| stats range(timestamp) as duration by user method

area34
New Member

my search
| rex field=msg "(?\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}).- \w{5}.\w{5}.\w{7}.\w{10}.(?P.)- user=(?.*)- method=(?\w+)"
| eval timeStamp=strptime(timestamp,"%F %T.%3Q")
| stats range(timeStamp) as call by user method

my result
user method call
1 WSxxx checkmethod
2 WSyyy getmethod
3 WStztzz getOBmethod

Now in the the field call is empty I want that field should count how often the user called method

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="raw
2020-04-15 07:18:28.978 WSABXXX checkXXXX
2020-04-15 08:18:28.968 WSABXXX checkXXXX"
| multikv forceheader=1
| rex "(?<timestamp>\S+\s\S+).(?<user>\S+).(?<method>\S+)"
| eval timeStamp=strptime(timestamp,"%F %T.%3Q")
| stats range(timeStamp) by user method

Check your REGEX and |eval timeStamp) ...result.

0 Karma

area34
New Member

Hi,

yeah now I want the the calls the field is empty...

index=*

| rex field=msg "(?\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}.\d{3}).- \w{5}.\w{5}.\w{7}.\w{10}.(?P.)- user=(?.*)- method=(?\w+)"
| eval timeStamp=strptime(timestamp,"%F %T.%3Q")
| stats range(timeStamp) as call by user action

sourc
|
|
V

user    method call

1 WSxxx checkmethod
2 WSyyy getmethod
3 WStztzz getOBmethod

what should I do if I want

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...