Generating response time report

[DFresh4130]

We have a search application with not so friendly formatted logging for reporting on. I'm having trouble extracting the response times from lines like below and then generating a response time report of some kind. Any suggestions?

2014-03-25 12:00:10,827 INFO [com.search.web.common.filter.PerformanceFilter] - /global/search.action,364ms query=ABC

Below is what I've come up with so far, but am stuck on how to accurately put the data into a report of some kind.

sourcetype="sfe" search.action | regex_raw="\d{2,5}ms"

[dkuk]

It'd probably be worth auto-extracting the response time into a field so that whenever you search for sourcetype "sfe" you have a field that represents response time.

Then you'll have a field that you can perform statistical commands on, such as max, min, avg etc.

With that in mind I'd create props.conf entry to hook into sourcetype sfe. Something like the below:

props.conf:

[sfe]
EXTRACT_sfe_resp_time = ,(?<resp_time>\d{1,6})ms

Then you could run your search through a timechart command something like this:

sourcetype=sfe search.action | timechart avg(resp_time) by host