Splunk Search

How to write a search to graph average time by site specific location using my sample data?

Engager

I'm trying to graph the average time of an event:

July 18, 2016 10:02 -> INFO -> Done with sync of project-high-med-2016-spf-1-0amssstandardoemmilestone to eurdc of 272 MB in 20.29167366027832 seconds

July 18, 2016 08:16 -> INFO -> Done with sync of shenzhen-hipad-telecommunication-technology-co-ltd/msm8909-la-1-1amssoem_milestone-major to tw of 24 MB in 14.404675483703613 seconds

So I want to display the results of average time per region:
eurdc= x seconds
tw= x seconds

Any suggestions?

0 Karma

Communicator

Try this:

yoursearch | rex "to\s(?<loghost>\w+)\sof\s\d+\sMB\sin\s(?<seconds>\d+\.\d+)\sseconds" | stats avg(seconds) by loghost

Engager

Seems to be working, can you explain a little bit the way to form the expression?

0 Karma

Communicator

The rex command is just extracting the needed fields loghost and seconds from the event logs.

Afterwards the stats command is calculating the needed average (avg) of seconds by loghost.

0 Karma