https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553788#M38441 <P>Seconds (inferred from the "secs" in the data)</P> Tue, 01 Jun 2021 06:37:28 GMT ITWhisperer 2021-06-01T06:37:28Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553775#M38437 <P>Hi Everyone,</P><P>I am getting<STRONG> total time taken</STRONG> field as shown below in my logs</P><P><SPAN class="t">on_1621717537363_2611781</SPAN><SPAN>,</SPAN><STRONG><SPAN class="t">3497</SPAN> <SPAN class="t">secs</SPAN>,</STRONG><SPAN class="t">Passed</SPAN><SPAN>,,</SPAN><SPAN class="t">E3</SPAN></P><P><SPAN class="t">621717537363_2611790<SPAN>,</SPAN><STRONG>926 secs</STRONG><SPAN>,</SPAN>Passed<SPAN>,,</SPAN>E3</SPAN></P><P><SPAN class="t">I want to calculate its Average. I tried with this query but its not working:</SPAN></P><P><SPAN class="t">index=abc source="/xyz"|eval fields=split(_raw,",")|eval job_id=mvindex(fields,0)|eval sourceType=mvindex(fields,1)|eval inputFilePath=mvindex(fields,2)|eval tableName=mvindex(fields,3)|eval inputRecordsCount=mvindex(fields,4)|eval processedRecordsCount=mvindex(fields,5)|eval startTime=mvindex(fields,6)|eval endTime=mvindex(fields,7)|eval loadAppendTimestampCol=mvindex(fields,8)|eval refreshType=mvindex(fields,9)|eval className=mvindex(fields,10)|eval applicationId=mvindex(fields,11)|eval totalTimeTaken=mvindex(fields,12)|eval status=mvindex(fields,13)|eval errorMessage=mvindex(fields,14)|eval Environment=mvindex(fields,15)|<STRONG>stats avg(totalTimeTaken) as AvgExecTime |eval AvgExecTime=round(AvgExecTime,2)</STRONG></SPAN></P><P><SPAN class="t"><STRONG>Can someone guide me on this.</STRONG></SPAN></P> Tue, 01 Jun 2021 05:46:22 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553775#M38437 aditsss 2021-06-01T05:46:22Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553778#M38438 <P>Hi</P><P>this should work.</P><LI-CODE lang="markup">| makeresults | eval _raw = " on_1621717537363_2611781,3497 secs,Passed,,E3 621717537363_2611790,926 secs,Passed,,E3" | multikv noheader=t ```above generates sample data``` | rex ",(?&lt;secs&gt;\d+) secs," | stats avg(secs) as AvgExecTime</LI-CODE><P>&nbsp;r. Ismo</P> Tue, 01 Jun 2021 06:11:01 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553778#M38438 isoutamo 2021-06-01T06:11:01Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553781#M38439 <P>Add this after the mvindex line for totalTimeTaken</P><LI-CODE lang="markup">| rex field=totalTimeTaken "(?&lt;totalTimeTaken&gt;\d+)"</LI-CODE> Tue, 01 Jun 2021 06:15:36 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553781#M38439 ITWhisperer 2021-06-01T06:15:36Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553786#M38440 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P><P>This will give me average in seconds or in minutes?</P> Tue, 01 Jun 2021 06:34:31 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553786#M38440 aditsss 2021-06-01T06:34:31Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553788#M38441 <P>Seconds (inferred from the "secs" in the data)</P> Tue, 01 Jun 2021 06:37:28 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553788#M38441 ITWhisperer 2021-06-01T06:37:28Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553794#M38443 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P><P>why its not working with Timechart when I am using below query:</P><P>index=abc source="xyz"|eval fields=split(_raw,",")|eval job_id=mvindex(fields,0)|eval sourceType=mvindex(fields,1)|eval inputFilePath=mvindex(fields,2)|eval tableName=mvindex(fields,3)|eval inputRecordsCount=mvindex(fields,4)|eval processedRecordsCount=mvindex(fields,5)|eval startTime=mvindex(fields,6)|eval endTime=mvindex(fields,7)|eval loadAppendTimestampCol=mvindex(fields,8)|eval refreshType=mvindex(fields,9)|eval className=mvindex(fields,10)|eval applicationId=mvindex(fields,11)|<STRONG>eval totalTimeTaken=mvindex(fields,12)|rex field=totalTimeTaken "(?&lt;totalTimeTaken&gt;\d+)"</STRONG>|eval status=mvindex(fields,13)|eval errorMessage=mvindex(fields,14)|eval Environment=mvindex(fields,15)|where Environment ="E3"|dedup job_id startTime endTime totalTimeTaken|<STRONG>timechart sum(totalTimeTaken) as TotalExecTime by job_id |eval TotalExecTime=round(TotalExecTime,2)|sort -TotalExecTime limit=10</STRONG></P> Tue, 01 Jun 2021 06:55:09 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-calculate-the-Average-of-the-Time-coming-in-sec/m-p/553794#M38443 aditsss 2021-06-01T06:55:09Z