Average response time, and count, by url path

[hdus001]

Hi,

I'm trying to create a table that shows me the number of times a URL is requested for and what its average response time is (for a given time period).

The events that contain the relevant information (url path, response time) look like this:
2014-07-02 16:04:26,716 INFO 8767 --- [p-1328426564-28] user=[ ] a.c.n.a.a.c.filters.RequestTimingFilter : Returning statusCode=[200] after time=[19ms] for method=[GET] path=[/atlas/v1/assets/adhoc/fsam/2LJT-07] queryString=[] userDn=[uid=GRAHAMHISCOCK,ou=internal users,ou=nbn,dc=nbnco,dc=com,dc=au]

In the above example, the url path is "/atlas/v1/assets/adhoc/fsam/2LJT-07" and the response time is 19 milliseconds.

The search I used is this:

path v1 | rex field=_raw "time=\[(?<responsetime>.*?)ms\]" | stats count,avg(num(responsetime)) by path

However, this seems to show me only the path and count, not average response time (this field is blank)

path count avg(num(responsetime))

[/atlas/v1/status/health] 46

[/atlas/v1/boundaries/fsam] 18

[/atlas/v1/assets/adhoc/fsam/2BLK-01] 17

Any ideas how I can obtain this information?

Thanks in advance.
Hans

[Ayn]

Why use any function at all? responsetime should already be numeric if correctly extracted. If it's not correctly extracted, then that's the problem that needs to be solved.

[MuS]

so, now you're able to accept this as the answer 😉

[hdus001]

Yup that fixed it 🙂 ...No need to use 'num' or 'tonumber' as its already a number!

[hdus001]

Just tried the same search with 'tonumber' instead of 'num'. Still has the same problem.

[MuS]

shouldn't this avg(num(responsetime)) be like avg(tonumber(responsetime)) ?