How to calculate the tota runtime from different logs?

[tchintam]

I have 100+ logs in my path say /abv/xyz/(All my logs). Each of the logs has the line: The total runtime is "zy" sec. (Example). How do I calculate the sum of all the runtime from different logs?

[FrankVl · Accepted solution]

Step 1: extract the runtime value into a field (e.g. the field runtime)
Step 2: run a search that sums the values of that field:

...your base search...
| stats sum(runtime) as TotalRuntime

If you need help with step 1, please provide an actual data sample, so we can provide suggestions for how to extract that.

[tchintam]

Hi Frank,

Each log has this line: The total runtime is 120 seconds.

Time varies from log to log though.

So, I would need to extract the time from there and sum the total. How do I do that?

Also, adding on, my doubt is, how do I go inside the log each time? There are 100+ logs. Only inside the log do I get the runtime.

[FrankVl]

You have those logs available in Splunk, right? Or is that also still something you need to accomplish first?

Assuming the logs are in splunk, with let's say index=foo and sourcetype=bar, you can run the following search.

index=foo sourcetype=bar
| rex "runtime\s+is\s+(?<runtime>\d+)"
| stats sum(runtime) as TotalRuntime

If you have this working, you can think about storing that field extraction permanently, such that it gets applied automatically to these logs and you don't have add that rex command any longer.