Why is division via EVAL is not working?

[chiennylin]

My raw event is:
07 Nov 2019 01:24:49 | INFO | DispatchThread: 6119 | *** Time taken to process 100 records 1009ms | GNS-C6CAE58A-3482-451B-A7B2-6F63DE58E4B3-002 | com.dhl.ms.sdm.jms.listeners.GNSMessageListener | onMessage |

i tried to get the number of records over time

| rex "Time taken to process(?[^\_]+)records(?[^ms]+)"
| eval aveDuration =recDuration/recNum
| table recNum recDuration aveDuration _raw

but, this is not returning the aveDuration even if i use the simple eval =recDuration/recNum
my rex is correct, and i even put in convert to num but, still not working.

HELP.

thanks

[woodcock]

Try this:

... | rex "Time taken to process(?[<recNum>\d+)\s*records\s*(?<recDuration>\d+)"
| eval aveDuration = recDuration / recNum
| table recNum recDuration aveDuration _raw

[mayurr98 · Accepted solution]

try this :

| rex "Time taken to process\s+(?<recNum>\d+)\s+records\s+(?<recDuration>\d+)" 
| eval aveDuration=recDuration/recNum 
| table recNum recDuration aveDuration _raw

[chiennylin]

Thanks! this helps!
this is now working. will take note on the whitespace for my rex moving forward.

[marycordova]

I don't think the regex is correct, it looks like it might be capturing leading whitespace, try Time\s+taken\s+to\s+process\s+(?<recNum>\d+)\s+records\s+(?<recDuration>\d+)ms and see if it helps.

Also, this might be overkill, but I like to be explicit in my SPL so I would do the following in the eval | eval aveDuration=('recDuration'/'recNum')