I have 7 web service calls which have varying response times. I have a timechart (LINE) ranging from 00:00 to 24:00, I would like to plot each web service call on that timechart but have a different color line for each web service call so I can compare them. Is there an app I can use or is there a way to plot all 7 calls with a different color line at search time? ... View more

I have a simple web service with a request and response called DeliverySchedule. The request and response have a unique identifier called a GUID which are in pairs. I'm trying to find the duration (response time) between the response and request. Here's my search which is returning some correct durations but also listing 0 for more than 400 events . I'm also missing a lot of events index=unleashed "deliveryschedule" | transaction GUID startswith="Request" endswith="Reply" | timechart avg(duration) GUID = "33efb817-1948-4c8f-bdf4-4111aa1941cc" in this case. We will only have 2 matching GUID's which are attached to the req/resp. They will be different for each req/resp. I also did a field extraction called 'GUID' to capture the GUID between the pipes.. REQUEST DEBUG 2015-05-13 15:31:40,590 fterReceiveRequest - Request Record : |33efb817-1948-4c8f-bdf4-4111aa1941cc | <GetDeliverySchedule xmlns="http://tempuri.org/"> <request> <DeliveryType /DotCom_Delivery">A</DeliveryType> <EndDate/DotCom_Delivery">2015-05-15</EndDate> <Region_StoreNo/DotCom_Delivery">970</Region_StoreNo> <Region_zip/DotCom_Delivery">11111</Region_zip> <StartDate/DotCom_Delivery">2015-05-13</StartDate> </request> </GetDeliverySchedule> RESPONSE DEBUG 2015-05-13 15:31:41,276 BeforeSendReply - Response Record : |33efb817-1948-4c8f-bdf4-4111aa1941cc | <GetDeliveryScheduleResponse xmlns="http://tempuri.org/"> <GetDeliveryScheduleResult xmlns:a="http://schemas.datacontract.org/2004/07/DotCom_Delivery" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"> <a:DeliveryCalendar> <a:Ranges> <a:DeliveryRange i:type="a:DeliveryDate"> <a:IsAvailableForDelivery>false</a:IsAvailableForDelivery> <a:Date>2015-05-13T00:00:00-04:00</a:Date> </a:DeliveryRange> <a:DeliveryRange i:type="a:DeliveryDate"> <a:IsAvailableForDelivery>false</a:IsAvailableForDelivery> <a:Date>2015-05-14T00:00:00-04:00</a:Date> </a:DeliveryRange> </a:Ranges> <a:TypeOfCalendar>DayType</a:TypeOfCalendar> <a:ZoneId>110</a:ZoneId> </a:DeliveryCalendar> <a:StatusCode>200</a:StatusCode> <a:StatusMessage>OK</a:StatusMessage> </GetDeliveryScheduleResult> </GetDeliveryScheduleResponse> ... View more

I need to lengthen the lines in my events so I went into Splunk\etc\system\local\props.conf and added [SRV-DCP01UVWS01] TRUNCATE = 20000 MAX_EVENTS = 20000 It is not seeing the host, but if I change it from the host to the source [ATG_Message_Log] then it will work correctly. I DO NOT want to use the source as it will affect other logging. I want to use the host This is a new host, do I have to define the host somewhere in Splunk so it can recognize it? ... View more