Splunk Search

How to group and count data from string?

vintik
Engager

I have the following query:

sourcetype=XXX Some query for * took * seconds to load

And this is a result of query:

I, [2016-09-28T11:01:21.616144 #23942]  INFO -- : Some query for authorizations took 8 seconds to load. JobID: 1475060473.4330475
I, [2016-09-28T11:01:21.113586 #20705]  INFO -- : Some query for authentications took 9 seconds to load. JobID: 1475060472.4330474
I, [2016-09-28T11:01:20.539219 #19285]  INFO -- : Some query for authentications took 8 seconds to load. JobID: 1475060472.4330473

But I need to get average time for each of operation type (authorizations and authentications from example):

authorizations: 8.5
authentications: 8

Is it possible?

0 Karma
1 Solution

somesoni2
Revered Legend

Assuming that both operation type and duration is not extracted, try like this

 sourcetype=XXX Some query for * took * seconds to load | rex "for (?<operation_type>\w+) took (?<duration>\d+) seconds" | stats avg(duration) as Average_Time by operation_type

View solution in original post

somesoni2
Revered Legend

Assuming that both operation type and duration is not extracted, try like this

 sourcetype=XXX Some query for * took * seconds to load | rex "for (?<operation_type>\w+) took (?<duration>\d+) seconds" | stats avg(duration) as Average_Time by operation_type
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...