How to extract "seconds" and "documents" fields from each event, chart the average of seconds/document, and alert if the average is greater than 1?

[MikeBertelsen]

Trying to get an alert from Splunk when an average for a specified time and number of documents > 1.
Example taken for this event:
TIME TAKEN : 2.59 second(s) , NO OF DOCS : 3

2.59/3 =.86333 seconds per document

We want to track if the value is 1 second per document.
Once we have that, if the trend is that this value continues to climb over, we want another alert to warn us of a potential memory leak.

Any help appreciated.

[woodcock]

Try this:

| rex "TIME TAKEN : (?<seconds>\S+).*NO OF DOCS : (?<documents>\d+)" | eval docsPerSecond = documents/seconds | where docsPerSecond > 1 | timechart span=1h avg(docsPerSecond)

[chimell]

Hi MikeBertelsen
Run the query that Woodcock gave you . Save it as alert by filling the important field