topic Re: how to calculate xdelay average per mouth in Splunk Search

how to calculate xdelay average per mouth

baoamin — Mon, 16 Apr 2018 11:51:57 GMT

hello

my company start to use splunk to check maillog

Jan 7 11:14:36 mailserver sm-mta[00228]: a070yZwR021222: to=, delay=00:00:25, xdelay=00:00:25, mailer=smtp, pri=0250112, relay=[10.140.12.43] [10.140.12.43],

how to calculate the average xdelay per mouth

please help me

thanks so much

Re: how to calculate xdelay average per mouth

adonio — Mon, 16 Apr 2018 17:21:10 GMT

hello there,

assuming you captured the values for the field xdelay you can try something like this, run it anywhere:

| makeresults count=1
| eval xdelay = "00:00:25, 00:01:13, 02:34:15, 00:32:11, 01:12:12"
| makemv delim="," xdelay
| mvexpand xdelay
| rex field="xdelay" "(?<xdelay_hour>\d{2}):(?<xdelay_min>\d{2}):(?<xdelay_sec>\d{2})"
| eval xdelay_duration_seconds = ((xdelay_hour*3600)+(xdelay_min*60)+xdelay_sec)

now calculate however you want, for example:
| timechart span=1m avg(xdelay_duration_seconds) as avg_xdelay
checkout below screenshot:

hope it helps

Re: how to calculate xdelay average per mouth

somesoni2 — Mon, 16 Apr 2018 18:04:33 GMT

Try something like this

Your current search with field _time and xdelay
| convert dur2sec(xdelay)
| timechart span=1mon avg(xdelay) as "AverageXDelay"

Re: how to calculate xdelay average per mouth

adonio — Mon, 16 Apr 2018 18:16:55 GMT

upvote for the function! dur2sec i will use it!

Re: how to calculate xdelay average per mouth

baoamin — Tue, 17 Apr 2018 01:13:53 GMT

thank you very much it works

but I also have a question that how to set the value of 0.577539820 like 0.577

thanks so much

Re: how to calculate xdelay average per mouth

adonio — Tue, 17 Apr 2018 01:21:28 GMT

use the eval round function ....
if it solved it for you, please accept the answer and up vote any comments / answers that you found helpful