Calculate the average run duration for a job and display as a visualization

christinaef07 — Thu, 19 Nov 2020 18:18:11 GMT

Hi everyone! In my logs coming in, I log the duration for a job to complete, for several different jobs. Example of duration:

1:17:42 -----> this would be 1 hr, 17 minutes, 42 seconds

How can i calculate the average duration for each job? I want something like this:

Jobs |. Duration

___________________

Job 1. |. 0:17:41

Job 2. |. 1:41:16

Job 3. |. 1:05:13

Re: Calculate the average run duration for a job and display as a visualization

richgalloway — Thu, 19 Nov 2020 21:27:58 GMT

Here's one way. There may be others.

... | rex field=duration "(?<hr>\d+):(?<min>\d+):(?<sec>\d+)" | eval durationSecs = (hr*3600) + (min*60) + sec | stats avg(durationSecs) as Duration by Jobs | fieldformat Duration = tostring(Duration, "duration")

topic Calculate the average run duration for a job and display as a visualization in Splunk Search

Calculate the average run duration for a job and display as a visualization

Re: Calculate the average run duration for a job and display as a visualization