Calculate transaction thruput

[steveirogers]

I am trying to calculate the "thruput" (i.e. number of records processed per second) for certain transactions.

Sample event records look like this showing number of records, corresponding file size and the duration:

• download job complete : records # = 1, file size = 303 : 39ms
• download job complete : records # = 1, file size = 313 : 72ms
• download job complete : records # = 7959, file size = 756286 : 1316ms
• download job complete : records # = 542962, file size = 62440829 : 34912ms
• download job complete : records # = 1294, file size = 123087 : 222ms

I would like to calculate "thruput" as the file size / duration (i.e. in ms). I figured I need to extract the duration to a field first since it is not in a name-value pair (and yes it is not consistent with the other fields, but I do not control the way the logs are written).

I have tried using the Extract Field option, but I cannot come up with a suitable matching expression. Could anyone help with that.

Once I get past that extraction, then I think I can do a "...|eval thruput=file size/duration"??

Any help or guidance would be greatly appreciated.

Thank you.

[bwooden]

Correct, in props.conf, you could use something like:

[your_sourcetype]
EXTRACT-duration = (?<duration>\d+)ms$
EXTRACT-size = file\ssize\s\=\s(?<files_size>\d+)

and in the search language, you would just use your eval command:

... | eval thruput = file_size / duration

[steveirogers]

Thanks very much. I am making progress. I am seeing the extraced fields in the fields list. I modified the second extract as follows: EXTRACT-size = file\s\size\s=\s(?\d+)

However when I run the "eval" I do not see any results. I will keep working with it and let you know.

Thanks.