Splunk Search

Why is stats avg(response_time) not working after extracting response_time?

Tioluwani-Ada
Engager

I am a beginner. Why is stats avg(response_time) not working after extracting response_time?

index="testing1" source="web_access_log_project2.txt" | erex response_time examples="7ms, 0ms, 17ms, 67ms, 77ms, 39ms " | stats count, avg(response_time)

Below is the sample event:

127.0.0.1 - - [17/Mar/2023:17:59:13.798 -0400] "HEAD /favicon.ico HTTP/1.1" 303 124 "" "Splunk/9.0.4 (Windows Server 10 Professional with Media Center Edition; arch=x64)" - 6414e2b1cc1a8e6558ec8 7ms
127.0.0.1 - - [17/Mar/2023:16:02:45.754 -0400] "HEAD /favicon.ico HTTP/1.1" 303 124 "" "Splunk/9.0.4 (Windows Server 10 Professional with Media Center Edition; arch=x64)" - 6414c765c11e7271cf148 0ms
127.0.0.1 - admin [09/Mar/2023:17:52:41.509 -0500] "GET /en-US/config?autoload=1 HTTP/1.1" 200 1874 "http://127.0.0.1:8000/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.63" - 640a6339821e0d9ba9848 49ms
127.0.0.1 - admin [09/Mar/2023:17:52:41.455 -0500] "GET /en-US/account/logout HTTP/1.1" 404 18942 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.63" - 640a6339741e0d987dc08 14ms

Labels (1)
0 Karma
1 Solution

yeahnah
Motivator

Hi @Tioluwani-Ada 

The "ms" in the response time field makes it a string so it needs to be stripped to make is a integer that can then have mathematical calculations done on it.

The following should meet your needs... 

index="testing1" source="web_access_log_project2.txt"
| rex "(?<response_time>\d+)ms$"  ``` strip out response time in ms ```
| stats count avg(response_time) AS avg_response_time

 Hope this helps

View solution in original post

0 Karma

Tioluwani-Ada
Engager

Thank you so much Yeahnah. It worked.

 

0 Karma

yeahnah
Motivator

Hi @Tioluwani-Ada 

The "ms" in the response time field makes it a string so it needs to be stripped to make is a integer that can then have mathematical calculations done on it.

The following should meet your needs... 

index="testing1" source="web_access_log_project2.txt"
| rex "(?<response_time>\d+)ms$"  ``` strip out response time in ms ```
| stats count avg(response_time) AS avg_response_time

 Hope this helps

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...