Hi All.
I am trying to calculate the response time from the logs below.
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=100sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=10sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=50sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=40sec
11-12-2019 23:34:45, 678 this event will calculate the sign in and sign out of the application, Success,=67, failed=121, |sumsuo=1.0|CompleteTime=130sec
|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx by PREFIX(completetime=)
|rename completetime= as Time
|timechart span=1d avg(Time) by host
|eval ResTime =round(,Time2)
When i am trying to run this query i am not bale to calculate the average of time because when i am doing PREFIX(completetime=) here sec word is also taking up.
How can i ignore it.
Use the tonumber() function to extract only the digits from the Time field.
|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx by PREFIX(CompleteTime=)
|rename CompleteTime as Time
|eval Time=tonumber(Time)
|timechart span=1d avg(Time) as ResTime by host
|eval ResTime =round(ResTime, 2)
In that case, try this alternative that uses rex to extract only the digits from Time.
|tstats count where index=xxxx host=abc OR host=cvb OR host=dgf OR host=ujh sourcetype=xxxx by PREFIX(CompleteTime=)
|rename CompleteTime as Time
|rex field=Time "(?<Time>\d+)"
|timechart span=1d avg(Time) as ResTime by host
|eval ResTime =round(ResTime, 2)