Why is stats avg(response_time) not working after extracting response_time?

[Tioluwani-Ada]

I am a beginner. Why is stats avg(response_time) not working after extracting response_time?

index="testing1" source="web_access_log_project2.txt" | erex response_time examples="7ms, 0ms, 17ms, 67ms, 77ms, 39ms " | stats count, avg(response_time)

Below is the sample event:

127.0.0.1 - - [17/Mar/2023:17:59:13.798 -0400] "HEAD /favicon.ico HTTP/1.1" 303 124 "" "Splunk/9.0.4 (Windows Server 10 Professional with Media Center Edition; arch=x64)" - 6414e2b1cc1a8e6558ec8 7ms
127.0.0.1 - - [17/Mar/2023:16:02:45.754 -0400] "HEAD /favicon.ico HTTP/1.1" 303 124 "" "Splunk/9.0.4 (Windows Server 10 Professional with Media Center Edition; arch=x64)" - 6414c765c11e7271cf148 0ms
127.0.0.1 - admin [09/Mar/2023:17:52:41.509 -0500] "GET /en-US/config?autoload=1 HTTP/1.1" 200 1874 "http://127.0.0.1:8000/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.63" - 640a6339821e0d9ba9848 49ms
127.0.0.1 - admin [09/Mar/2023:17:52:41.455 -0500] "GET /en-US/account/logout HTTP/1.1" 404 18942 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.63" - 640a6339741e0d987dc08 14ms

[Tioluwani-Ada]

Thank you so much Yeahnah. It worked.

[yeahnah · Accepted solution]

Hi @Tioluwani-Ada 

The "ms" in the response time field makes it a string so it needs to be stripped to make is a integer that can then have mathematical calculations done on it.

The following should meet your needs... 

index="testing1" source="web_access_log_project2.txt"
| rex "(?<response_time>\d+)ms$"  ``` strip out response time in ms ```
| stats count avg(response_time) AS avg_response_time

 Hope this helps