Splunk Search

Best way to format out time field for average time

agentguerry
Path Finder

I am using the linux time command to see how long it takes to run a process.

My logs show as runtime=0m0.000s

So example would be runtime=2m47.012s

What is the best way to parse the output that the command "time provides" to be able to get a time chart of the results?

I tried just doing a timechart, but with no results of the actual time above.
index=metrics process=dailybackup
| timechart span=4h avg(runtime)

0 Karma

adonio
Ultra Champion

you are trying to perform a statistical function avg on field that contains strings: 2m47.012s
there are many ways to approach this challenge, here is one using rex and eval to create an integer for seconds:

| makeresults count=1
| eval runtime="2m47.012s,4m4.912s,12m7.020s,0m9.999s,0m0.712s,3m7.012s,14m4.920s,1m17.029s,0m4.880s,0m0.001s"
| makemv delim="," runtime
| mvexpand runtime
| streamstats count as event_count
| eval _time = _time - event_count * 1000
| rename COMMENT as "the above generates data with different time for timechart, below is the solution" 
| rex field=runtime "(?<minutes>\d+)m(?<seconds>\d+).(?<miliseconds>\d+)"
| eval min_to_sec = minutes * 60
| eval mili_to_sec = exact(miliseconds / 1000)
| eval total_runtime_seconds = exact(seconds + min_to_sec + mili_to_sec)
| timechart span=3000s avg(total_runtime_seconds) as avg_run_time

hope it helps

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...