Regular expression works separately but, not able to work it within Splunk query.

[mappu]

Hello,

I'm trying to find average response time of all events after the field totalTimeTaken. Thing is, when I tested this regular expression on Regular Expression Site

It shows I'm extracting the field and value correctly but, when I put the same into the Splunk statement it is not yielding the expected result. 

Log: 

{"Record: {"ATimeTaken":0, "BTimeTaken":0 ,"totalTimeTaken":4},{anotherFields}}

Query:

| makeresults ns=project*
| eval _raw="\"totalTimeTaken\":4" 
| rex field=_raw "\"totalTimeTaken\":+(?<Response_Time>\d+)"
| stats avg(response_time)

Could I know where I'm going wrong?

[mappu]

Removed the eval statement and got it working. 

[burwell]

Hi. 

So you tried

| makeresults ns=project*
| eval _raw="\"totalTimeTaken\":4" 
| rex field=_raw "\"totalTimeTaken\":+(?<Response_Time>\d+)"
| stats avg(response_time)

And there are two problems.

1) the first makeresults .. I don't know what the ns=project* is. Here's the reference
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults

2) your rex is extracting the value into the field Response_Time but then use do stats avg on response_time in lowercase.  Case matters in Splunk field names.

Here's what seems to work

| makeresults=1
| eval _raw="\"totalTimeTaken\":4" 
| rex field=_raw "\"totalTimeTaken\":+(?<Response_Time>\d+)"
| stats avg(Response_Time)

[mappu]

Thanks.

And, It is taking only one event and returning me average response time as 4 or any number I put in the eval field. I couldn't grab all the numbers in such logs/events and take average value.