Extract values bucketed by time

[varsuvius]

Hello,

I have a bucketed chart in this format:

Is it possible to calculate the geometric mean of the values in each timestamp and add it to another field??

[sundareshr · Accepted solution]

Try this

.... | mvexpand solrTime | eval natural_logs=ln(solrTime) | stats values(solrTime) as solrTime mean(natural_logs) as log_mean by _time | eval geometric_mean = exp(log_mean)

Got this from this great post by @aljohnson

[varsuvius]

Did not work.

I tried this command:

• | rex field=_raw ".*Solr Time: (?\d+)" | mvexpand solrTime | eval natural_log=ln(solrTime) | bucket span=10m _time | stats values(solrTime) as solrTime mean(natural_logs) as log_mean by _time | eval geometric_mean = exp(log_mean)

[sundareshr]

I don't believe you need the rex command. Add this to the query that resulted in the table you have in your screenshot. Make sure the table has two columns _time and solrTime

[varsuvius]

The query between --- is the initial one that generates that chart.

--- * | rex field=_raw ".*Solr Time: (?\d+)" | bucket span=10m _time | chart values(solrTime) by _time --- | mvexpand solrTime | eval natural_log=ln(solrTime) | stats values(solrTime) as solrTime mean(natural_logs) as log_mean by _time | eval geometric_mean = exp(log_mean)

After that, the results are returning only the timestamp.

[sundareshr]

Try this

---  | rex field=_raw ".*Solr Time: (?\d+)" | bucket span=10m _time | chart values(solrTime) as solrTime by _time | mvexpand solrTime | eval natural_log=ln(solrTime) | stats values(solrTime) as solrTime mean(natural_logs) as log_mean by _time | eval geometric_mean = exp(log_mean)

[varsuvius]

Still not working.

[sundareshr]

Try this. Fixed typo

---  | rex field=_raw ".*Solr Time: (?\d+)" | bucket span=10m _time | chart values(solrTime) as solrTime by _time | mvexpand solrTime | eval natural_logs=ln(solrTime) | stats values(solrTime) as solrTime mean(natural_logs) as log_mean by _time | eval geometric_mean = exp(log_mean)

If this doesn't work, try taking out one segment at a time to see where it stops working.

[varsuvius]

It's working now. Thanks a lot for your help. 😄