Calculate avg task duration

[snabi]

Thanks in advance...

- My server log contains the following

xxxxxxxx|xx -> Finished embeding fallback task 00:01:00.0004165

xxxxxxxx|xx -> Finished embeding fallback task 00:00:49.0004062

• My goal is to calculate average time spent in seconds on these tasks over last couple hours

Out-put should look like : ** (AVG) embeding fallback duration 54.50041135**

SPLUNK query attempted : Not working......

"Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.\d+)" |eval duration=strptime(embeding_fallback_task_duration,"%H:%M:%S")| eval base=strptime("00:00:00.00","%H:%M:%S") | eval secs=duration-base | stats avg(duration) as "(AVG) embeding fallback duration"

[snabi]

Thank you.... found a fix

"Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.\d+):(?.\d+):(?.\d+).(?.\d+)" | eval embeding_fallback_task_duration = ((hours*60*60)+(minutes*60)+seconds+(subSeconds/1000000)) | stats avg(embeding_fallback_task_duration)

For...
Finished embeding fallback task 00:00:00.1918088
Finished embeding fallback task 00:00:00.1136647

Out put...
avg(embeding_fallback_task_duration)
0.152737

[MuS]

Because your regex will only match the 00:00:00 hours:minute:seconds numbers and none of the .subsecond numbers

[snabi]

This seems to be working...

"Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.\d+):(?.\d+):(?.\d+)" | eval embeding_fallback_task_duration = ((hours*60*60)+(minutes*60)+seconds) | timechart avg(embeding_fallback_task_duration)

But ..why my output shows 0.00000 ... for following logs?

Finished embeding fallback task 00:00:00.1284716
Finished embeding fallback task 00:00:00.1496968

Out-put i am getting...
avg(embeding_fallback_task_duration)
0.000000

[martin_mueller]

Are your duarion and secs fields calculated correctly before the stats?

[richgalloway]

I think your stats avg(duration) should be stats avg(secs).

[snabi]

Thanks for the correction.....still not returning any output..

Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.d+)" |eval duration=strptime(embeding_fallback_task_duration,"%H:%M:%S")| eval base=strptime("00:00:00.00","%H:%M:%S") | eval secs=duration-base | stats avg(secs) as "(AVG) embeding fallback duration"