topic Re: How do I extract a string of numbers using Rex to work the AVG out from a string to a number in Splunk Search

How do I extract a string of numbers using Rex to work the AVG out from a string to a number

joe06031990 — Tue, 21 Jul 2020 10:00:11 GMT

How do I extract a string of numbers using Rex to work the AVG out from a string to a number As it is showing as blank. The number format 00:00:00.0000000.

thanks Joe

Re: How do I extract a string of numbers using Rex to work the AVG out from a string to a number

to4kawa — Tue, 21 Jul 2020 11:59:40 GMT

| makeresults count=20 | eval _raw="sample: ".printf("%02d",random() % 24).":".printf("%02d",random() % 60).":".printf("%02d",random() % 60).".".printf("%07d",random() % 9999999) | rename COMMENT as "this is sample" | rename COMMNET as "rex extracts two fields" | rex "(?<times>\d{2}:\d{2}:\d{2})\.(?<sec>\d{7})" | convert dur2sec(times) | eval sec="0.".sec | eval seconds=times+sec | eventstats avg(seconds)

convert is useful.

Re: How do I extract a string of numbers using Rex to work the AVG out from a string to a number

isoutamo — Tue, 21 Jul 2020 12:03:25 GMT

as we discussed on Issue with the AVG however min and max work fine. this is probably on part of date + time field not pure string? Are you interested only for hour, min, sec, fraction part or full timestamp?

Here is how you could convert this time to epoch:

Re: How do I extract a string of numbers using Rex to work the AVG out from a string to a number

joe06031990 — Tue, 21 Jul 2020 13:02:47 GMT

Hi, I just need to pull the AVG from the string field.

Re: How do I extract a string of numbers using Rex to work the AVG out from a string to a number

isoutamo — Tue, 21 Jul 2020 13:12:26 GMT

You cannot calculate AVG from string field. Avg function is available only for numeric fields.

https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Aggregatefunctions

There are more what and when you could use AVG and other aggregate functions.

Of course if string field's contains numeric values you could first transform string to numeric and then use AVG e.g. with stats to get the average.

Re: How do I extract a string of numbers using Rex to work the AVG out from a string to a number

joe06031990 — Tue, 21 Jul 2020 13:16:10 GMT

Hi, I did try Convert to Convert the string into Numeric but got the same issue.