How do convert a field and report on the average response time?

Question

I have a field in my Apache logs that's defined as "MicroSeconds". This is the response time in microseconds for a specific call in Apache to our Weblogic back ends.

I'm trying to generate a real time chart on the average response times based on the "Microseconds" field. I'd like to be able to convert microseconds to milliseconds so I don't freak out our users when they see a transaction hit 4000..

How would I do that? The basic search right now is:

index="uat_apache_logs" /pbng | timechart avg(MicroSeconds)

which works good..I just need to convert it to milliseconds..

Thanks in advance.

Accepted Answer

3

You can use the "eval" command to perform operations in field values: http://www.splunk.com/base/Documentation/latest/SearchReference/Eval

In your case:

... | timechart avg(MicroSeconds) as avgus | eval avg_milliseconds = avgus/1000

link

answered 26 Apr '10, 18:46

gkanapathy ♦
26.2k●1●6●22
accept rate: 42%

That works. Anyway to make drilldown work with this? I get a "# PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command"

Brian

(26 Apr '10, 19:18) Brian Osburn

1

Answer is disarmingly simple - just do the eval before the timechart instead of after. "eval milliseconds=MicroSeconds*1000 | timechart avg(milliseconds)"

(26 Apr '10, 19:41) nick ♦

How do convert a field and report on the average response time?

Follow this question

Splunk Resources

Related questions