topic Re: Average Timespan in Splunk Search

Average Timespan

RagtimeWilly — Wed, 30 Jul 2014 15:42:10 GMT

I have a large amount of logs in the following format:

2014-07-30 14:23:51,802 - MyApp - 6 - INFO - Performance - process=Update, timeElapsed=00:00:00.0940611

I have a filter which displays only these entries:

Service=MyApp source="C:\Logs\MyApp-Performance.log" process=Update

Would someone be able to explain how I can update this go that it give me the average timeElapsed across all entries for the selected period?

Apologies, I'm new to this and have tried a few different things but can't seem to figure it out.

Thanks in advance,

Re: Average Timespan

tom_frotscher — Wed, 30 Jul 2014 15:46:28 GMT

Hi,

you can append an | stats avg(timeElapsed) to your search query.

Re: Average Timespan

somesoni2 — Wed, 30 Jul 2014 15:55:51 GMT

Give this a try

Service=MyApp source="C:\Logs\MyApp-Performance.log" process=Update| eval duration=strptime(timeElapsed,"%H:%M:%S.%6Q")-relative_time(now(),"@d") | stats avg(duration) as avgTimeElapsed

The field timeElapsed is string to need to convert it to seconds before calculating avg.

Re: Average Timespan

RagtimeWilly — Wed, 30 Jul 2014 15:56:41 GMT

Thanks for the response.

This is one of the things I tried but I just get a message saying "No results found"

Re: Average Timespan

Jeff_Lightly_Sp — Wed, 30 Jul 2014 16:08:14 GMT

Take a look at:

http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/CommonEvalFunctions

Re: Average Timespan

RagtimeWilly — Wed, 30 Jul 2014 16:08:51 GMT

This worked a charm!

Thank you!

Re: Average Timespan

tom_frotscher — Wed, 30 Jul 2014 16:16:54 GMT

Yeah, sorry! Did't saw that the field is not properly converted for use with stats. But @somesoni2 got it!