I have an api which has a number of endpoint, e.g., /health, /version, /specification and so on... I have a query which extracts the response time from logs and creates stats as duration. Here is the query - index=*my_index* namespace="my_namespace" "Logged Request" | rex field=log "OK:(?<duration>\d+)"| stats avg(duration) as Response_Time by log Here's an example of generated log - " 2021-08-23 20:36:15.627 [INFO ] [-19069] a.a.ActorSystemImpl - Logged Request:HttpMethod(POST):http://host/manager/resource_identifier/ids/getOrCreate/bulk?streaming=true&dscid=52wu9o-b5bf6995-38c5-4472-90d7-2f3edb780276:200 OK:2622 " The query that I've shared extracts the duration from every log. I need to find a way to extract the name of the endpoint and calculate the mean of duration of each endpoint? Can some one help me with this, I am really new to splunk. ... View more

Here is a log example -  {"log_time":"2021-08-27T07:16:46.178275260+00:00","output":"stdout","log":"2021-08-27 07:16:46.178 [INFO ] [her-49] a.a.ActorSystemImpl - Logged Request:HttpMethod(POST):http://id-test.api-gateway.sit.ls.api.com/repos/hrn:idmrepo-sit::ol:idm_team_internal_test/ids/getOrCreate/bulk?streaming=true&dscid=GvaIrM-cb4005f6-a828-4fd7-9f54-6082e2912716:200 OK:4","k8scluster":"borg-dev-1-aws-west-1","namespace":"*","env":"DEV","app_time":"","time":"1630048606.178275260"}   I need to extract the digits after "OK:" (here highlighted in red color) as time in ms.  I am just started using splunk. I am trying this -  rex "([^\:]+$)(?P<duration>.+)" | stats exactperc98(duration) as P98 avg(duration) as AVG by log But this is not working. ... View more