https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127923#M34723 <P>shouldn't this <CODE>avg(num(responsetime))</CODE> be like <CODE>avg(tonumber(responsetime))</CODE> ?</P> Wed, 02 Jul 2014 06:33:46 GMT MuS 2014-07-02T06:33:46Z https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127922#M34722 <P>Hi,</P> <P>I'm trying to create a table that shows me the number of times a URL is requested for and what its average response time is (for a given time period).</P> <P>The events that contain the relevant information (url path, response time) look like this:<BR /> 2014-07-02 16:04:26,716 INFO 8767 --- [p-1328426564-28] user=[ ] a.c.n.a.a.c.filters.RequestTimingFilter : Returning statusCode=[200] after time=[19ms] for method=[GET] path=[/atlas/v1/assets/adhoc/fsam/2LJT-07] queryString=[] userDn=[uid=GRAHAMHISCOCK,ou=internal users,ou=nbn,dc=nbnco,dc=com,dc=au] </P> <P>In the above example, the url path is "/atlas/v1/assets/adhoc/fsam/2LJT-07" and the response time is 19 milliseconds. </P> <P>The search I used is this:</P> <PRE><CODE>path v1 | rex field=_raw "time=\[(?&lt;responsetime&gt;.*?)ms\]" | stats count,avg(num(responsetime)) by path </CODE></PRE> <P>However, this seems to show me only the path and count, not average response time (this field is blank) </P> <P>path count avg(num(responsetime))</P> <P>[/atlas/v1/status/health] 46<BR /><BR /> [/atlas/v1/boundaries/fsam] 18<BR /><BR /> [/atlas/v1/assets/adhoc/fsam/2BLK-01] 17 </P> <P>Any ideas how I can obtain this information?</P> <P>Thanks in advance.<BR /> Hans</P> Wed, 02 Jul 2014 06:19:15 GMT https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127922#M34722 hdus001 2014-07-02T06:19:15Z https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127923#M34723 <P>shouldn't this <CODE>avg(num(responsetime))</CODE> be like <CODE>avg(tonumber(responsetime))</CODE> ?</P> Wed, 02 Jul 2014 06:33:46 GMT https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127923#M34723 MuS 2014-07-02T06:33:46Z https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127924#M34724 <P>Just tried the same search with 'tonumber' instead of 'num'. Still has the same problem.</P> Wed, 02 Jul 2014 06:40:47 GMT https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127924#M34724 hdus001 2014-07-02T06:40:47Z https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127925#M34725 <P>Why use any function at all? <CODE>responsetime</CODE> should already be numeric if correctly extracted. If it's not correctly extracted, then that's the problem that needs to be solved.</P> Wed, 02 Jul 2014 07:11:07 GMT https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127925#M34725 Ayn 2014-07-02T07:11:07Z https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127926#M34726 <P>Yup that fixed it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> ...No need to use 'num' or 'tonumber' as its already a number!</P> Wed, 02 Jul 2014 07:23:15 GMT https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127926#M34726 hdus001 2014-07-02T07:23:15Z https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127927#M34727 <P>so, now you're able to accept this as the answer <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Wed, 02 Jul 2014 07:39:44 GMT https://community.splunk.com/t5/Splunk-Search/Average-response-time-and-count-by-url-path/m-p/127927#M34727 MuS 2014-07-02T07:39:44Z