splunkrequest-response

Splunk: How to get a timechart regarding the extracted _time values for which range() was applied?


With the following query I get the stats about Requesttime, Responsetime and Request-Responsetime (diff) of a specific id:

(index=something "Request") OR (index=something "Response")
| rex field=_raw "id\":\"(?<id>[a-z0-9-]+)" 
| table _time id
| stats min(_time) as Requesttime, max(_time) as Responsetime, range(_time) as diff by id

What I now want to get is a timechart with the average diff per 1 minute.

I tried to replace the stats command by a second table command and by the timechart command but nothing did the job.

Note: Requesttime and Reponsetime are in different events.


Solution

  • I found a solution:

    (index=something "Request") OR (index=something "Response") 
    | rex field=_raw "id\":\"(?<id>[a-z0-9-]+)" 
    | stats earliest(_time) as earliestTime latest(_time) as latestTime by id
    | eval duration=latestTime-earliestTime
    | eval _time=earliestTime
    | timechart span=1m avg(duration) as avgRequestResponseTime 
    | fillnull value=0 avgRequestResponseTime
    | eval avgRequestResponseTime=round(avgRequestResponseTime,4)