Splunk Search

how to calculate xdelay average per mouth

baoamin
New Member

hello

my company start to use splunk to check maillog

Jan 7 11:14:36 mailserver sm-mta[00228]: a070yZwR021222: to=, delay=00:00:25, xdelay=00:00:25, mailer=smtp, pri=0250112, relay=[10.140.12.43] [10.140.12.43],

how to calculate the average xdelay per mouth

please help me

thanks so much

Tags (1)
0 Karma

somesoni2
Revered Legend

Try something like this

Your current search with field _time and xdelay
| convert dur2sec(xdelay)
| timechart span=1mon avg(xdelay) as "AverageXDelay"

adonio
Ultra Champion

upvote for the function! dur2sec i will use it!

0 Karma

baoamin
New Member

thank you very much it works

but I also have a question that how to set the value of 0.577539820 like 0.577

thanks so much

0 Karma

adonio
Ultra Champion

use the eval round function ....
if it solved it for you, please accept the answer and up vote any comments / answers that you found helpful

0 Karma

adonio
Ultra Champion

hello there,

assuming you captured the values for the field xdelay you can try something like this, run it anywhere:

| makeresults count=1
| eval xdelay = "00:00:25, 00:01:13, 02:34:15, 00:32:11, 01:12:12"
| makemv delim="," xdelay
| mvexpand xdelay
| rex field="xdelay" "(?<xdelay_hour>\d{2}):(?<xdelay_min>\d{2}):(?<xdelay_sec>\d{2})"
| eval xdelay_duration_seconds = ((xdelay_hour*3600)+(xdelay_min*60)+xdelay_sec)

now calculate however you want, for example:
| timechart span=1m avg(xdelay_duration_seconds) as avg_xdelay
checkout below screenshot:
alt text

hope it helps

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...