Can you help me get a number value and average it?

[orchapellico]

I am trying to get a value, in this case it is the # of seconds to respond, so that I can graph it or set alerts to it. Below are the log entries I am dealing with.

STATUS | wrapper  | main    | 2019/02/10 10:38:08.885 | Pinging the JVM took 5 seconds to respond.

So I need help pulling the number and the search for being able to graph this per a host.

[woodcock]

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| rex "took\s+(?<responseSeconds>\d+)\s+seconds"
| timechart avg(responseSeconds) BY host

[skoelpin]

Assuming your log format is consistent, this will do the trick

index=... sourcetype=...
| rex JVM\s\took\s(?<jvm_duration>\d+)\sseconds
| timechart avg(jvm_duration) AS jvm_duration by host