How do I edit my search to get the average response time without using the transaction command?

[nidhiagrawal]

I am trying to get average response time without the transaction command. Events are running into millions, so the search takes a lot of time.

Here is what I have:

index=myindex  "string to match"  | rex "messageId(?<myMsgId>[^\<]+)"  | rex "refToMessageId(?<myMsgId>[^\<]+)" | rex field=_raw "(?<fldDay>[\d\-]{10}).*\s\[\s[a-zA-Z0-9\-\:\.]" | stats earliest(_time) AS startTime, latest(_time) AS endTime, count as TotalEvents by fldDay, myMsgId | eval responseTime=endTime-startTime

It should be simple, but I'm a novice here. How do I get the average of response time?

Thanks in advance.

[nidhiagrawal]

Can I please ask a follow up question. how do I add the condition: calculate average only if TotalEvents > 1.

[masonmorales · Accepted solution]

It looks like you've already calculated the duration (response time) of each transaction using your eval. If you just want an average response time for everything, you can just do:

index=myindex "string to match" | rex "messageId(?<myMsgId>[^<]+)" | rex "refToMessageId(?<myMsgId>[^<]+)" | rex field=_raw "(?<fldDay>[d-]{10}).*s[s[a-zA-Z0-9-:.]" | stats earliest(_time) AS startTime, latest(_time) AS endTime, count as TotalEvents by fldDay, myMsgId | eval responseTime=endTime-startTime | stats avg(responseTime) as avgResponseTime