Stream field details

This topic provides information about the specific protocol fields captured by Splunk Stream.

Latency information

Field

Description

time_taken

The event duration in microseconds, i.e. time difference between timestamps of the last and first packets that comprise an event plus client_rtt time (if applicable for that protocol). For example, for HTTP request/response event (sourcetype=stream:http) a first packet is the first request packet and the last packet is either the last response packet or the client ack packet acknowledging the last response packet, if captured. For a “flow” event (tcp or udp) the first and last packets are the first and last packets in the entire flow, respectively.

The following metrics are only calculated for tcp-based protocol events:

Field	Description
client_rtt	The average round trip time in microseconds from the client to the point of capture — calculated based on a complex algorithm involving correlating data packet timestamps with corresponding acknowledgment packet timestamps.
server_rtt	The average round trip time in microseconds from the server to the point of capture — calculated based on a complex algorithm involving correlating data packet timestamps with corresponding acknowledgment packet timestamps.

The following metrics are only calculated for request/response protocols such as HTTP/FTP/SMTP etc.

Field	Description
request_time	The number of microseconds that it took the client to send the request, i.e. time difference between last and first request data packets (0 if request fits in a single packet).
response_time	Similar to request time, but for the server response data.
reply_time	The number of microseconds between the last request packet and the first response packet.
request_ack_time	The time difference between the last request packet and the ACK packet from the server acknowledging the last request packet.
response_ack_time	Similar to request_ack_time, but timing the acknowledgment of the last response packet.