topic Re: Customised query- How to calculate the response time from the logs below? in Splunk Enterprise

How to calculate in customized query the response time from the logs below?

Ash1 — Tue, 29 Nov 2022 13:59:08 GMT

Hi All.
I am trying to calculate the response time from the logs below.

11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=100sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=10sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=50sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=40sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=130sec

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx by PREFIX(completetime=) |rename completetime= as Time |timechart span=1d avg(Time) by host |eval ResTime =round(,Time2)

When i am trying to run this query i am not bale to calculate the average of time because when i am doing PREFIX(completetime=) here sec word is also taking up.
How can i ignore it.

Re: Customised query- How to calculate the response time from the logs below?

richgalloway — Tue, 29 Nov 2022 13:25:11 GMT

Use the tonumber() function to extract only the digits from the Time field.

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx by PREFIX(CompleteTime=) |rename CompleteTime as Time |eval Time=tonumber(Time) |timechart span=1d avg(Time) as ResTime by host |eval ResTime =round(ResTime, 2)

Re: Customised query- How to calculate the response time from the logs below?

Ash1 — Mon, 28 Nov 2022 22:26:53 GMT

@richgalloway ,
when i tried to give tonumber i am still seeing Sec
|evak Time=tonumber(Time)

Re: Customised query- How to calculate the response time from the logs below?

richgalloway — Tue, 29 Nov 2022 13:24:55 GMT

In that case, try this alternative that uses rex to extract only the digits from Time.

|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx by PREFIX(CompleteTime=) |rename CompleteTime as Time |rex field=Time "(?<Time>\d+)" |timechart span=1d avg(Time) as ResTime by host |eval ResTime =round(ResTime, 2)