topic Re: How to write a search to graph average time by site specific location using my sample data? in Splunk Search

How to write a search to graph average time by site specific location using my sample data?

XtC — Tue, 29 Sep 2020 10:19:18 GMT

I'm trying to graph the average time of an event:

July 18, 2016 10:02 -> INFO -> Done with sync of project-high-med-2016-spf-1-0_amss_standard_oem_milestone to eurdc of 272 MB in 20.29167366027832 seconds

July 18, 2016 08:16 -> INFO -> Done with sync of shenzhen-hipad-telecommunication-technology-co-ltd/msm8909-la-1-1_amss_oem_milestone-major to tw of 24 MB in 14.404675483703613 seconds

So I want to display the results of average time per region:
eurdc= x seconds
tw= x seconds

Any suggestions?

Re: How to write a search to graph average time by site specific location using my sample data?

Raschko — Mon, 18 Jul 2016 18:50:05 GMT

Try this:

yoursearch | rex "to\s(?<loghost>\w+)\sof\s\d+\sMB\sin\s(?<seconds>\d+\.\d+)\sseconds" | stats avg(seconds) by loghost

Re: How to write a search to graph average time by site specific location using my sample data?

XtC — Mon, 18 Jul 2016 19:00:42 GMT

Seems to be working, can you explain a little bit the way to form the expression?

Re: How to write a search to graph average time by site specific location using my sample data?

Raschko — Mon, 18 Jul 2016 19:13:23 GMT

The rex command is just extracting the needed fields loghost and seconds from the event logs.

Afterwards the stats command is calculating the needed average (avg) of seconds by loghost.