topic Re: Can you help me get a number value and average it? in Splunk Search

Can you help me get a number value and average it?

orchapellico — Sun, 10 Feb 2019 17:45:02 GMT

I am trying to get a value, in this case it is the # of seconds to respond, so that I can graph it or set alerts to it. Below are the log entries I am dealing with.

STATUS | wrapper  | main    | 2019/02/10 10:38:08.885 | Pinging the JVM took 5 seconds to respond.

So I need help pulling the number and the search for being able to graph this per a host.

Re: Can you help me get a number value and average it?

skoelpin — Sun, 10 Feb 2019 18:54:35 GMT

Assuming your log format is consistent, this will do the trick

index=... sourcetype=...
| rex JVM\s\took\s(?<jvm_duration>\d+)\sseconds
| timechart avg(jvm_duration) AS jvm_duration by host

Re: Can you help me get a number value and average it?

woodcock — Tue, 12 Feb 2019 08:06:18 GMT

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| rex "took\s+(?<responseSeconds>\d+)\s+seconds"
| timechart avg(responseSeconds) BY host