calculating average bandwidth

[DTERM]

I've got a log that looks like the following after extraction....

RPD_MPLS_PATH_UP: MPLS path up on LSP host1 path bandwidth 12471992 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host2 path bandwidth 12011384 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host4 path bandwidth 287627232 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host4 path bandwidth 139387648 bps

RPD_MPLS_PATH_UP: MPLS path up on LSP host5 path bandwidth 12090064 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host2 (lsp hosta) bandwidth changed, path bandwidth 55613496 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host1 (lsp hostb) bandwidth changed, path bandwidth 75705096 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host2 (lsp hostb) bandwidth changed, path bandwidth 830783296 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host3 (lsp hostc) bandwidth changed, path bandwidth 821814080 bps

RPD_MPLS_PATH_BANDWIDTH_CHANGE: MPLS path host1 (lsp hosta) bandwidth changed, path bandwidth 818999808 bps

My question is how can I calculate the average bandwidth from that log?

I've tried several different variations of the following with no luck...

| rex field=_raw "bandwidth (?)" | stats avg(bandwidth)

[jharty_splunk]

Try this:

RPD_MPLS_PATH* | rex field=_raw "path bandwidth (?\w+)"

You need to specify the field vale (w+)