topic Re: Calculate avg task duration in Splunk Search

Calculate avg task duration

snabi — Mon, 28 Sep 2020 18:16:27 GMT

Thanks in advance...

- My server log contains the following

xxxxxxxx|xx -> Finished embeding fallback task 00:01:00.0004165

xxxxxxxx|xx -> Finished embeding fallback task 00:00:49.0004062

My goal is to calculate average time spent in seconds on these tasks over last couple hours

Out-put should look like : ** (AVG) embeding fallback duration 54.50041135**

SPLUNK query attempted : Not working......

"Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.\d+)" |eval duration=strptime(embeding_fallback_task_duration,"%H:%M:%S")| eval base=strptime("00:00:00.00","%H:%M:%S") | eval secs=duration-base | stats avg(duration) as "(AVG) embeding fallback duration"

Re: Calculate avg task duration

richgalloway — Thu, 27 Nov 2014 17:35:16 GMT

I think your stats avg(duration) should be stats avg(secs).

Re: Calculate avg task duration

snabi — Mon, 28 Sep 2020 18:16:29 GMT

Thanks for the correction.....still not returning any output..

Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.d+)" |eval duration=strptime(embeding_fallback_task_duration,"%H:%M:%S")| eval base=strptime("00:00:00.00","%H:%M:%S") | eval secs=duration-base | stats avg(secs) as "(AVG) embeding fallback duration"

Re: Calculate avg task duration

martin_mueller — Thu, 27 Nov 2014 18:25:38 GMT

Are your duarion and secs fields calculated correctly before the stats?

Re: Calculate avg task duration

snabi — Mon, 28 Sep 2020 18:15:57 GMT

This seems to be working...

"Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.\d+):(?.\d+):(?.\d+)" | eval embeding_fallback_task_duration = ((hours*60*60)+(minutes*60)+seconds) | timechart avg(embeding_fallback_task_duration)

But ..why my output shows 0.00000 ... for following logs?

Finished embeding fallback task 00:00:00.1284716
Finished embeding fallback task 00:00:00.1496968

Out-put i am getting...
avg(embeding_fallback_task_duration)
0.000000

Re: Calculate avg task duration

MuS — Thu, 27 Nov 2014 20:41:56 GMT

Because your regex will only match the 00:00:00 hours:minute:seconds numbers and none of the .subsecond numbers

Re: Calculate avg task duration

snabi — Mon, 28 Sep 2020 18:16:32 GMT

Thank you.... found a fix

"Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.\d+):(?.\d+):(?.\d+).(?.\d+)" | eval embeding_fallback_task_duration = ((hours*60*60)+(minutes*60)+seconds+(subSeconds/1000000)) | stats avg(embeding_fallback_task_duration)

For...
Finished embeding fallback task 00:00:00.1918088
Finished embeding fallback task 00:00:00.1136647

Out put...
avg(embeding_fallback_task_duration)
0.152737