for example, i have the following 7 logs,
2011-DEC-17 slotid="Location-Maps-US-Sunnyvale" delta_msec="1487" seq="3"
2011-DEC-17 slotid="Location-Maps-US-MountainView" delta_msec="1445" seq="2"
2011-DEC-17 slotid="Location-Maps-US-SF" delta_msec="1465" seq="2"
2011-DEC-17 slotid="Location-Store-CA-MountainView" delta_msec="1445" seq="2"
2011-DEC-17 slotid="Location-Store-CA-SF" delta_msec="1245" seq="2"
2011-DEC-17 slotid="Location-Msg-CA-MountainView" delta_msec="1445" seq="2"
2011-DEC-17 slotid="Location-Msg-CA-SF" delta_msec="1245" seq="2"
i want to calculate a new field(avg_msec) based on the "slotid"
we would like to calculate an average for all logs matching "Location-Maps"
we would like to calculate an average for all logs matching "Location-Store"
we would like to calculate an average for all logs matching "Location-Msg"
Can somebody help write the search string? Thanks!
Hi there,
Something along the lines of;
...|rex field=slotid "Location-(?<ZZZZ>[^-]+)-" | stats avg(delta_msec) AS avg_msec by ZZZZ
this should extract "Maps", "Store" and "Msg" into a new field called ZZZZ, which you subsequently can run ordinary stats
commands on.
Hope this helps,
Kristian
Hi there,
Something along the lines of;
...|rex field=slotid "Location-(?<ZZZZ>[^-]+)-" | stats avg(delta_msec) AS avg_msec by ZZZZ
this should extract "Maps", "Store" and "Msg" into a new field called ZZZZ, which you subsequently can run ordinary stats
commands on.
Hope this helps,
Kristian