Archive

How to calculate the tota runtime from different logs?

Path Finder

I have 100+ logs in my path say /abv/xyz/(All my logs). Each of the logs has the line: The total runtime is "zy" sec. (Example). How do I calculate the sum of all the runtime from different logs?

0 Karma
1 Solution

Ultra Champion

Step 1: extract the runtime value into a field (e.g. the field runtime)
Step 2: run a search that sums the values of that field:

...your base search...
| stats sum(runtime) as TotalRuntime

If you need help with step 1, please provide an actual data sample, so we can provide suggestions for how to extract that.

View solution in original post

Ultra Champion

Step 1: extract the runtime value into a field (e.g. the field runtime)
Step 2: run a search that sums the values of that field:

...your base search...
| stats sum(runtime) as TotalRuntime

If you need help with step 1, please provide an actual data sample, so we can provide suggestions for how to extract that.

View solution in original post

Path Finder

Hi Frank,

Each log has this line: The total runtime is 120 seconds.

Time varies from log to log though.

So, I would need to extract the time from there and sum the total. How do I do that?

Also, adding on, my doubt is, how do I go inside the log each time? There are 100+ logs. Only inside the log do I get the runtime.

0 Karma

Ultra Champion

You have those logs available in Splunk, right? Or is that also still something you need to accomplish first?

Assuming the logs are in splunk, with let's say index=foo and sourcetype=bar, you can run the following search.

index=foo sourcetype=bar
| rex "runtime\s+is\s+(?<runtime>\d+)"
| stats sum(runtime) as TotalRuntime

If you have this working, you can think about storing that field extraction permanently, such that it gets applied automatically to these logs and you don't have add that rex command any longer.