Group aggregate on logs

[xiaoyuew]

for example, i have the following 7 logs,

2011-DEC-17 slotid="Location-Maps-US-Sunnyvale" delta_msec="1487" seq="3"

2011-DEC-17 slotid="Location-Maps-US-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Maps-US-SF" delta_msec="1465" seq="2"

2011-DEC-17 slotid="Location-Store-CA-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Store-CA-SF" delta_msec="1245" seq="2"

2011-DEC-17 slotid="Location-Msg-CA-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Msg-CA-SF" delta_msec="1245" seq="2"

i want to calculate a new field(avg_msec) based on the "slotid"
we would like to calculate an average for all logs matching "Location-Maps"
we would like to calculate an average for all logs matching "Location-Store"
we would like to calculate an average for all logs matching "Location-Msg"

Can somebody help write the search string? Thanks!

[kristian_kolb · Accepted solution]

Hi there,

Something along the lines of;

...|rex field=slotid "Location-(?<ZZZZ>[^-]+)-" | stats avg(delta_msec) AS avg_msec by ZZZZ

this should extract "Maps", "Store" and "Msg" into a new field called ZZZZ, which you subsequently can run ordinary stats commands on.

Hope this helps,

Kristian