Splunk Search

Average Timespan

Explorer

I have a large amount of logs in the following format:

2014-07-30 14:23:51,802 - MyApp - 6 - INFO - Performance - process=Update, timeElapsed=00:00:00.0940611

I have a filter which displays only these entries:

Service=MyApp source="C:\Logs\MyApp-Performance.log" process=Update

Would someone be able to explain how I can update this go that it give me the average timeElapsed across all entries for the selected period?

Apologies, I'm new to this and have tried a few different things but can't seem to figure it out.

Thanks in advance,

Tags (2)
1 Solution

Revered Legend

Give this a try

Service=MyApp source="C:\Logs\MyApp-Performance.log" process=Update| eval duration=strptime(timeElapsed,"%H:%M:%S.%6Q")-relative_time(now(),"@d") | stats avg(duration) as avgTimeElapsed 

The field timeElapsed is string to need to convert it to seconds before calculating avg.

View solution in original post

Revered Legend

Give this a try

Service=MyApp source="C:\Logs\MyApp-Performance.log" process=Update| eval duration=strptime(timeElapsed,"%H:%M:%S.%6Q")-relative_time(now(),"@d") | stats avg(duration) as avgTimeElapsed 

The field timeElapsed is string to need to convert it to seconds before calculating avg.

View solution in original post

Explorer

This worked a charm!

Thank you!

0 Karma

Communicator

Hi,

you can append an | stats avg(timeElapsed) to your search query.

Yeah, sorry! Did't saw that the field is not properly converted for use with stats. But @somesoni2 got it!

0 Karma

Explorer

Thanks for the response.

This is one of the things I tried but I just get a message saying "No results found"

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!