topic Custom Query in Splunk Search

Custom Query

vpalleti — Wed, 29 May 2013 18:54:12 GMT

I look for all strings as shown below. I need to calculate the number of such calls (8 in this case) and the average of (3, 5, 8, 4, 6, 12, 4, 15). It would show in graph as number of calls and average time. Can some help on this please?

stat: Encoder return in 3 ms
stat: Encoder return in 5 ms
stat: Encoder return in 8 ms
stat: Encoder return in 4 ms
stat: Encoder return in 6 ms
stat: Encoder return in 12 ms
stat: Encoder return in 4 ms
stat: Encoder return in 15 ms

Re: Custom Query

lguinn2 — Wed, 29 May 2013 19:27:40 GMT

This might do it -

Data as a table

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| bucket span=1h _time
| stats count avg(ms) as AvgMs by _time

Graph of count

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| timechart span=1h count

Graph of average ms

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| timechart span=1h avg(ms) as AvgMs

Re: Custom Query

Gilberto_Castil — Wed, 29 May 2013 19:30:53 GMT

You need to extract the data and then enumerate the count of events and calculate the average for the extracted value.

  sourcetype="answers-1369855768" 
| rex field=_raw "return\sin\s(?<return_in_ms>\d+)\s+\w+"
| stats count(return_in_ms) AS count avg(return_in_ms) AS avg

That will render something like this: