Thank you both for your help. @richgalloway Unfortunately your solution still won't accept fields that only have hours and not days. I need to pass it several times based of several hours to several days. @isoutamo response wasn't exactly what I wanted but ultimately got me to the solution I wanted as it takes all time ranges. This is exactly what I was looking for just incase it helps anyone else. It takes a list of times and calculates the meantime and presents it in a readable format for a dashboard widget. | makeresults
| eval _raw="Completiontime
1 day, 3:10:49
1 day, 0:55:03
22:43:24
2 days, 7:57:01"
| multikv forceheader=1
| rename COMMENT as "Previous lines generates sample data"
| rex field="Completiontime" "((?<days>\d+) days?,\s*)?(?<hours>\d+):(?<mins>\d+):(?<secs>\d+)"
| eval days = coalesce(days, 0), hours = coalesce(hours, 0), mins = coalesce(mins, 0), secs = coalesce(secs, 0)
| eval meantime = days * 86400 + hours * 3600 + mins * 60 + secs
| stats avg(meantime) as duration
| eval duration = tostring(round(duration), "duration")
| eval durationFormatted=replace(duration,"(\d*)\+*(\d+):(\d+):(\d+)","\1 days, \2:\3:\4 hrs")
| table durationFormatted
... View more
