query explanation

[DTERM]

Cab someone please explain what the following parts of the query do (just the bolded portion, not the entire query). Thanks.

The duration field that is being calculated looks like myapp_duration=0d 0h 0m 0s in the native format.

The whole search:

index=myapp NOT EIT_Net NOT businessUnit=EIT |
eval myapp_duration=replace(replace(replace(myapp_duration,"d\s","+"),"h|m|s",""),"\s",":") 
| convert dur2sec(myapp_duration) 
| stats avg(myapp_duration) as avg_myapp_duration by severity 
| eval avg_myapp_duration=tostring(round(avg_myapp_duration,0),"duration")
| eval severity=case(severity==0,"Cleared", 
  severity==1,"Intermediate", 
  severity==2,"Warning",   
  severity==3,"Maintenance", 
  severity==4,"Major",
  severity==5,"Critical") 
| rename severity as Severity 
| rename avg_myapp_duration as "Average Duration"

Portion of interest:

eval myapp_duration=replace(replace(replace(myapp_duration,"d\s","+"),"h|m|s",""),"\s",":") 
| convert dur2sec(myapp_duration) 
| stats avg(myapp_duration) as avg_myapp_duration by severity 
| eval avg_myapp_duration=tostring(round(avg_myapp_duration,0),"duration")

[Drainy]

@DTERM, you should really accept some answers - just to say thanks to the people that have helped you 🙂 (Click on the tick on the answer to accept it)

[sideview · Accepted solution]

Well it takes the myapp_duration field, and replaces every occurrence of "ds" with "+", then from that output it removes every occurrence of the literal string "h|m|s".

Then still in the same expression it replaces every occurrence of the character "s" with ":".

Then this modified version of the myapp_duration field gets assigned back to overwrite the original value of myapp_duration in each result row.

Then it gets piped to the convert command which will turn that field from a human readable time string into a number of seconds.

Then it's all piped to the stats command, which will graph the average of myapp_duration for each unique value of severity, where each value of severity has its own row, and there's a column called "avg_myapp_duration".

Last but not least, another eval command will first round that value to an integer, then use the tostring function to turn it back into a string of the form "HH:MM:SS"

This page is the reference you want to use to look up all the little eval commands and arguments:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

[DTERM]

Wow, great explanation. May take a while to digest. Thanks much!

🙂