I am a beginner. Why is stats avg(response_time) not working after extracting response_time?
index="testing1" source="web_access_log_project2.txt" | erex response_time examples="7ms, 0ms, 17ms, 67ms, 77ms, 39ms " | stats count, avg(response_time)
Below is the sample event:
127.0.0.1 - - [17/Mar/2023:17:59:13.798 -0400] "HEAD /favicon.ico HTTP/1.1" 303 124 "" "Splunk/9.0.4 (Windows Server 10 Professional with Media Center Edition; arch=x64)" - 6414e2b1cc1a8e6558ec8 7ms 127.0.0.1 - - [17/Mar/2023:16:02:45.754 -0400] "HEAD /favicon.ico HTTP/1.1" 303 124 "" "Splunk/9.0.4 (Windows Server 10 Professional with Media Center Edition; arch=x64)" - 6414c765c11e7271cf148 0ms 127.0.0.1 - admin [09/Mar/2023:17:52:41.509 -0500] "GET /en-US/config?autoload=1 HTTP/1.1" 200 1874 "http://127.0.0.1:8000/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.63" - 640a6339821e0d9ba9848 49ms 127.0.0.1 - admin [09/Mar/2023:17:52:41.455 -0500] "GET /en-US/account/logout HTTP/1.1" 404 18942 "" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.63" - 640a6339741e0d987dc08 14ms
... View more