How do I get the average response times for all services without specifying each service name in a search?

[chanukhya]

I am trying to get average response times of all services (services1.. service n). I am able to get average response time by using the following search.

index = app1 "service1"|timechart avg(processTime)

Here is my log format.

0000037f SystemOut     O {"serviceName":"service 1"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}

0000037f SystemOut     O {"serviceName":"service 6"|"loggerTime":"05-03-2015 07:25:16:723 PDT"|"csrMemberId":null|"versionId":"1.0.0"|"processTime":"116 msec"|"status":"Success"|"Logging":"SerivceTracking"|"statusCode":null}

How can i get the average response times for all the services (service1..service n).., without mentioning the service name in the search string?

[sundareshr · Accepted solution]

Try this

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | stats avg(processTime) as avgtime by svcnm

OR

.... | rex "serviceName\":\"(?<svcnm>[^\"]+)\"" | timechart span=1h avg(processTime) as avgtime by svcnm

[richgalloway]

Perhaps index = app1 "service*"|timechart avg(processTime)?

[chanukhya]

This doesn't display the service name. I would like to have the service name and avg response times together.