Splunk Search

Calculate average, min, max time in ms based on string in event log

rajnsoni92
Explorer

I am a beginner in Splunk queries. I might would be asking for some simple query but I am not able to construct it after searching a lot. Below is my sample event from message field 

 

REPORT RequestId: 288f34e9-5572-4816-d21e-9fcf5965fad0 Duration: 206.64 ms ..

 

I can get all events matching this criteria, but I want to do average, min and max of value present in duration in millisecond. Any help on this would be appreciated.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "Duration: (?<duration>[\d\.]+) ms"
| stats avg(duration) as avg min(duration) as min max(duration) as max

View solution in original post

rajnsoni92
Explorer

Thanks @ITWhisperer it worked 🙂

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "Duration: (?<duration>[\d\.]+) ms"
| stats avg(duration) as avg min(duration) as min max(duration) as max
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2024 Splunk Career Impact Report

We’ve been buzzing with excitement about the recent validation of Splunk Education! The 2024 Splunk Career ...

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...