Hourly count of a string with min, max, and avg of time taken in 0.000 sec

[runiyal]

In my log file, I have lot of messages saying upload or search got completed in x seconds. Like -

Search Completed successfully in 0.698 seconds
Upload Completed successfully in 2.529 seconds

We need a report that tells us the total count on hourly basis but with it it should also calculate Min/Max/Avg time (second) spent for in each of that operation. Result should be like -

Activity Count Min Max Avg
Upload

Search

[richgalloway]

Assuming you have no existing extractions, something like this should get you started.

index = foo | rex "(?P<Activity>\w+) Completed successfully in (?P<secs>\d+\.\d+) seconds" | stats count(secs) as Count min(secs) as Min max(secs) as Max avg(secs) as Avg by Activity | table Activity Count Min Max Avg