Group aggregate on logs

xiaoyuew — Tue, 20 Dec 2011 22:05:31 GMT

for example, i have the following 7 logs,

2011-DEC-17 slotid="Location-Maps-US-Sunnyvale" delta_msec="1487" seq="3"

2011-DEC-17 slotid="Location-Maps-US-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Maps-US-SF" delta_msec="1465" seq="2"

2011-DEC-17 slotid="Location-Store-CA-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Store-CA-SF" delta_msec="1245" seq="2"

2011-DEC-17 slotid="Location-Msg-CA-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Msg-CA-SF" delta_msec="1245" seq="2"

i want to calculate a new field(avg_msec) based on the "slotid"
we would like to calculate an average for all logs matching "Location-Maps"
we would like to calculate an average for all logs matching "Location-Store"
we would like to calculate an average for all logs matching "Location-Msg"

Can somebody help write the search string? Thanks!

Re: Group aggregate on logs

kristian_kolb — Wed, 21 Dec 2011 11:07:39 GMT

Hi there,

Something along the lines of;

...|rex field=slotid "Location-(?<ZZZZ>[^-]+)-" | stats avg(delta_msec) AS avg_msec by ZZZZ

this should extract "Maps", "Store" and "Msg" into a new field called ZZZZ, which you subsequently can run ordinary stats commands on.

Hope this helps,

Kristian

topic Group aggregate on logs in Splunk Search

Group aggregate on logs

Re: Group aggregate on logs