Average duration

[DTERM]

What is the syntax to obtain the average duration for each severity type in a query? A field exists called app_duration=0d 0h 40m 3s. I need the average for each severity type.

Thanks.

[bwooden · Accepted solution]

First convert the app_duration to a format convert can use. Then, use convert to store app_duration in seconds. Next, average all seconds by severity_type. Finally, re-format avg_app_duration for each severity_type in the human readable format of HH:MM:SS.

eval app_duration=replace(replace(replace(app_duration,"d\s","+"),"h|m|s",""),"\s",":") 
| convert dur2sec(app_duration) 
| stats avg(app_duration) as avg_app_duration by severity_type 
| eval avg_app_duration=tostring(round(avg_app_duration,0),"duration")