Hello, we are using Uberagent with Splunk in our Cloud Environment inventx.ch.
It is not clear from the documentation, how the field NetTargetSendLatencyMs is calculated. Since there is also NetTargetSendLatencyCount field, it implies several TCP Connections are reported here in one event. Thus, is the Latency then calculated as the MEAN, MEDIAN, MIN MAX or differently?
regards
Data Science Team Inventx
Hi there,
We try to document everything we can. Further explanations on the inner workings are available on request. I sent you an email with further explanations for NetTargetSendLatencyMs.
By the way: the next version of uberAgent will include a kernel module for everything network-related which gives you way more accurate latency metrics as well as new ones like Jitter.
Hi Dominik, I have the same question on NetTargetSendLatencyMs. Could you please point to the same documentation?
Background to this question:
For being more precise we are looking on NetTargetSendLatencyMs to find out outliers - users whose connection from home to certain internal systems are reported as significantly slower.
Thank you very much for any replies!
Hi Agim,
I emailed you further explanations for NetTargetSendLatencyMs.
Thank you Dominik,
Would you be able to to point on how to interpret the latency to the same IP address if you see these data? Business is actually asking to find the outliers - those whose connections from home are super slow to hit the same target and I thought NetTargetSendLatencyMs could help.
Hi Agim,
uberAgent's Machine Network Communication dashboard should be of great help.
Additionally, I created the following search that lists all hosts communicating with a specific IP and port, descending by latency. Just change IP and port to your needs.
| pivot `uA_DM_Process_NetworkTargetPerformance` Process_NetworkTargetPerformance
sum(NetTargetSendLatencyCount) as SumNetTargetSendLatencyCount
sum(NetTargetSendDurationMs) as SumNetTargetSendDurationMs
latest(User) as User
splitrow
host as "Source host"
filter NetTargetRemoteAddress is "10.1.1.20"
filter NetTargetRemotePort = 443
| eval "Avg. TCP send latency (ms)"=round(SumNetTargetSendDurationMs/SumNetTargetSendLatencyCount,1)
| sort limit=100 - "Avg. TCP send latency (ms)"
| table
"Source host"
User
"Avg. TCP send latency (ms)"
Note that NetTargetSendLatencyMs is not used directly in that search, but NetTargetSendDurationMs. Please have a look at our documentation for the latter.
Sorry, I've missed your data table. As per may last reply, NetTargetSendLatencyMs on its own is not meaningful. Instead, use NetTargetSendDurationMs and NetTargetSendLatencyCount to calculate the latency (like I did in the search in my last reply).
This was a beautiful query and produced exactly what we wanted to list top outliers!
Thank you very much Dominik!
Would you provide a similar "response time" query to an internal website?
You can do that in the dashboard Browser Web App Performance.
Set the filter to your website:
Settings for the data table:
Hi Dominik, this is fantastic! Thank you very much for sharing both these approaches. I will post a separate question about Work from Home dashboards.