Splunk Search

Hourly count of a string with min, max, and avg of time taken in 0.000 sec

runiyal
Path Finder

In my log file, I have lot of messages saying upload or search got completed in x seconds. Like -

Search Completed successfully in 0.698 seconds
Upload Completed successfully in 2.529 seconds

We need a report that tells us the total count on hourly basis but with it it should also calculate Min/Max/Avg time (second) spent for in each of that operation. Result should be like -

Activity Count Min Max Avg
Upload

Search

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming you have no existing extractions, something like this should get you started.

index = foo | rex "(?P<Activity>\w+) Completed successfully in (?P<secs>\d+\.\d+) seconds" | stats count(secs) as Count min(secs) as Min max(secs) as Max avg(secs) as Avg by Activity | table Activity Count Min Max Avg
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...