Custom Query

[vpalleti]

I look for all strings as shown below. I need to calculate the number of such calls (8 in this case) and the average of (3, 5, 8, 4, 6, 12, 4, 15). It would show in graph as number of calls and average time. Can some help on this please?

stat: Encoder return in 3 ms
stat: Encoder return in 5 ms
stat: Encoder return in 8 ms
stat: Encoder return in 4 ms
stat: Encoder return in 6 ms
stat: Encoder return in 12 ms
stat: Encoder return in 4 ms
stat: Encoder return in 15 ms

[Gilberto_Castil · Accepted solution]

You need to extract the data and then enumerate the count of events and calculate the average for the extracted value.

  sourcetype="answers-1369855768" 
| rex field=_raw "return\sin\s(?<return_in_ms>\d+)\s+\w+"
| stats count(return_in_ms) AS count avg(return_in_ms) AS avg

That will render something like this:

[lguinn2]

This might do it -

Data as a table

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| bucket span=1h _time
| stats count avg(ms) as AvgMs by _time

Graph of count

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| timechart span=1h count 

Graph of average ms

yoursearchhere
| rex "Encoder return in (?<ms>\d+) ms"
| timechart span=1h avg(ms) as AvgMs