×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
ksuyash
Explorer
Member since: ‎06-29-2022
‎10-19-2024
Community Statistics
Posts 3
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎06-29-2022
View All

Re: count by response time range

by in Splunk Search
‎10-18-2024 04:21 PM
‎10-18-2024 04:21 PM
I'm having similar query but when using the below case .. onlt <=500 and >=1500 are getting counted in stats  duration =6000's are also getting counted in >1500ms case not sure why index=* | rex "TxDurationInMillis=(?<TxDurationInMillis>\d+)" | eval ResponseTime = tonumber(TxDurationInMillis) | eval ResponseTimeCase=case( ResponseTime <= 500, "<=500ms", ResponseTime > 500 AND ResponseTime <= 1000, ">500ms and <=1000ms", ResponseTime > 1000 AND ResponseTime <= 1400, ">1000ms and <=1400ms", ResponseTime > 1400 AND ResponseTime < 1500, ">1400ms and <1500ms", ResponseTime >= 1500, ">=1500ms" ) | table TxDurationInMillis ResponseTime ResponseTimeCase ... View more

Re: How to fetch time in splunk logs for events wi...

by in Splunk Enterprise
‎06-29-2022 05:50 PM
‎06-29-2022 05:50 PM
It was really helpful  Thank you so much  I'm getting time in Unix format  1656483082.160 Any easy way to convert it ... View more

How to fetch time in splunk logs for events with p...

by in Splunk Enterprise
‎06-29-2022 05:26 PM
‎06-29-2022 05:26 PM
6/29/22 4:58:14.526 PM   2022-06-29 17:58:14.526 [Task1] INFO Task1 - Published Task1 received  id 101   6/29/22 4:59:14.526 PM   2022-06-29 17:58:14.526 [Task1] INFO Task1 - Published Task1 done  id 101 I'm trying  to fetch time for both the events (when it is received and when the task is done)  and calculate the difference between them in form of table  I tried  index=source "Published Task 1" | rex "id" (?<ID>\d+)  | table  ID start_time End_time difference _time ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎10-19-2024 02:57 AM
Karma given to
View All