Splunk Search

Group aggregate on logs

Path Finder

for example, i have the following 7 logs,

2011-DEC-17 slotid="Location-Maps-US-Sunnyvale" delta_msec="1487" seq="3"

2011-DEC-17 slotid="Location-Maps-US-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Maps-US-SF" delta_msec="1465" seq="2"

2011-DEC-17 slotid="Location-Store-CA-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Store-CA-SF" delta_msec="1245" seq="2"

2011-DEC-17 slotid="Location-Msg-CA-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Msg-CA-SF" delta_msec="1245" seq="2"

i want to calculate a new field(avg_msec) based on the "slotid"
we would like to calculate an average for all logs matching "Location-Maps"
we would like to calculate an average for all logs matching "Location-Store"
we would like to calculate an average for all logs matching "Location-Msg"

Can somebody help write the search string? Thanks!

Tags (2)
0 Karma
1 Solution

Ultra Champion

Hi there,

Something along the lines of;

...|rex field=slotid "Location-(?<ZZZZ>[^-]+)-" | stats avg(delta_msec) AS avg_msec by ZZZZ

this should extract "Maps", "Store" and "Msg" into a new field called ZZZZ, which you subsequently can run ordinary stats commands on.

Hope this helps,

Kristian

View solution in original post

Ultra Champion

Hi there,

Something along the lines of;

...|rex field=slotid "Location-(?<ZZZZ>[^-]+)-" | stats avg(delta_msec) AS avg_msec by ZZZZ

this should extract "Maps", "Store" and "Msg" into a new field called ZZZZ, which you subsequently can run ordinary stats commands on.

Hope this helps,

Kristian

View solution in original post