Splunk Search

how to find out average response time for all events by looking at two fields in same event msg ?

splunkDevendra
Explorer


I've JSON Object in msg field as :

"objectA":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

I want to find out Average Total time taken by Successful responses i.e. in above example second attempts response time should be considered as it's success and not first attempts response time.
Total time taken = response time - requestTime;

so how to find out :
1. Average Response of All successful events found
2. Table with count for response time less than 1sec, between 1 sec to 2 sec, between 2sec to 3 sec, greater than 3 sec

Can you please help with Query ?

Thank you so much for your help and efforts.

Labels (5)
0 Karma

splunkDevendra
Explorer

Sample Data : 

"objectA":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

 


"objectB":{
"aggrStatus":"FAILURE",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
}
]
}


"objectC":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"SUCCESS",
"responses":[
{
"requestTime":1626330378365,
"responseTime":1626330378622,
"status":"SUCCESS"
}
]
}
]
}

 


"objectD":{
"aggrStatus":"SUCCESS",
"attempts":[
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
{
"aggrStatus":"FAILURE",
"responses":[
{
"requestTime":1626329472707,
"responseTime":1626329474713,
"status":"FAILURE"
}
]
},
]
}


Let's assume Object A to D are results of search. and in my case, Only Object A and C should be considered for calculation as they are success and object B and D are failure. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?s)\"object\w\":(?<object>.*)"
| spath input=object path=attempts{} output=attempts
| mvexpand attempts
| spath input=attempts path=responses{} output=responses
| spath input=responses
| where status="SUCCESS"
| eval response=floor((responseTime-requestTime)/1000)
| stats count by response
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...