How to calculate the Average of the Time coming in sec

[aditsss]

Hi Everyone,

I am getting total time taken field as shown below in my logs

on_1621717537363_2611781,3497 secs,Passed,,E3

621717537363_2611790,926 secs,Passed,,E3

I want to calculate its Average. I tried with this query but its not working:

index=abc source="/xyz"|eval fields=split(_raw,",")|eval job_id=mvindex(fields,0)|eval sourceType=mvindex(fields,1)|eval inputFilePath=mvindex(fields,2)|eval tableName=mvindex(fields,3)|eval inputRecordsCount=mvindex(fields,4)|eval processedRecordsCount=mvindex(fields,5)|eval startTime=mvindex(fields,6)|eval endTime=mvindex(fields,7)|eval loadAppendTimestampCol=mvindex(fields,8)|eval refreshType=mvindex(fields,9)|eval className=mvindex(fields,10)|eval applicationId=mvindex(fields,11)|eval totalTimeTaken=mvindex(fields,12)|eval status=mvindex(fields,13)|eval errorMessage=mvindex(fields,14)|eval Environment=mvindex(fields,15)|stats avg(totalTimeTaken) as AvgExecTime |eval AvgExecTime=round(AvgExecTime,2)

Can someone guide me on this.

[ITWhisperer · Accepted solution]

Add this after the mvindex line for totalTimeTaken

| rex field=totalTimeTaken "(?<totalTimeTaken>\d+)"

[aditsss]

@ITWhisperer 

why its not working with Timechart when I am using below query:

index=abc source="xyz"|eval fields=split(_raw,",")|eval job_id=mvindex(fields,0)|eval sourceType=mvindex(fields,1)|eval inputFilePath=mvindex(fields,2)|eval tableName=mvindex(fields,3)|eval inputRecordsCount=mvindex(fields,4)|eval processedRecordsCount=mvindex(fields,5)|eval startTime=mvindex(fields,6)|eval endTime=mvindex(fields,7)|eval loadAppendTimestampCol=mvindex(fields,8)|eval refreshType=mvindex(fields,9)|eval className=mvindex(fields,10)|eval applicationId=mvindex(fields,11)|eval totalTimeTaken=mvindex(fields,12)|rex field=totalTimeTaken "(?<totalTimeTaken>\d+)"|eval status=mvindex(fields,13)|eval errorMessage=mvindex(fields,14)|eval Environment=mvindex(fields,15)|where Environment ="E3"|dedup job_id startTime endTime totalTimeTaken|timechart sum(totalTimeTaken) as TotalExecTime by job_id |eval TotalExecTime=round(TotalExecTime,2)|sort -TotalExecTime limit=10

[aditsss]

@ITWhisperer 

This will give me average in seconds or in minutes?

[ITWhisperer]

Seconds (inferred from the "secs" in the data)

[isoutamo]

Hi

this should work.

| makeresults 
| eval _raw = "
on_1621717537363_2611781,3497 secs,Passed,,E3
621717537363_2611790,926 secs,Passed,,E3"
| multikv noheader=t
 ```above generates sample data```
| rex ",(?<secs>\d+) secs,"
| stats avg(secs) as AvgExecTime

 r. Ismo