topic Re: splunk search in Splunk Search

splunk search

foysal0124 — Mon, 15 Feb 2021 07:26:32 GMT

I have an event value like this 2021-02-15 18:07:33,936, where the last value after comma(936) means the response time in ms. i tried to extract that value and want to average response time but it did not work.

how i can extract the value after comma from that field. i tried something like this

avg(mvindex(split(TimeStamp,","),-1)) as AverageResponse

TimeStamp=2021-02-15 18:07:33,936

Best Regards

Foysal

Re: splunk search

scelikok — Mon, 15 Feb 2021 07:33:57 GMT

Hi @foysal0124,

You use rex command like below;

| rex field=TimeStamp "\,(?<AverageResponse>\d+)"

Re: splunk search

gcusello — Mon, 15 Feb 2021 07:36:12 GMT

Hi @foysal0124,

you can extract the values between commas using a regex and then calculate average using the stats command, something like this:

Your_search | rex ",(?<response_time>\d+)," | stats avg(response_time) AS average

if in your logs there's the possibility to have also other numbers between commas, you have to use a just a little more complex regex like this:

Your_search | rex "^\d+-\d+-\d+\s+\d+:\d+:\d+,(?<response_time>\d+)," | stats avg(response_time) AS average

that you can test at https://regex101.com/r/q4VyFQ/1

Ciao.

Giuseppe

Re: splunk search

foysal0124 — Mon, 15 Feb 2021 11:05:01 GMT

awesome, it worked

Re: splunk search

foysal0124 — Mon, 15 Feb 2021 11:05:37 GMT

awesome test tool, thanks

Re: splunk search

foysal0124 — Mon, 15 Feb 2021 11:06:46 GMT

awesome, it worked, thanks for ur help