Hi,
I have some events which are related to file processing.
each file process have sub process with sub process ID and time taken to complete that sub process.
to know time taken for file process i need to add all sub process times.
my events are like this.
index=ABC source=trxfxfgf.log
Event 1 : myfile.txt sub_process_id: asgr1001 Total Time Taken: 10sec
Event 2 : myfile.txt sub_process_id: shhhtsh1002 Total Time Taken: 20sec.
Event 3 : myfile.txt sub_process_id: shsdthds1003 Total Time Taken: 30sec.
Event 4: myfile.txt sub_process_id: tdhtr1004 Total Time Taken: 40sec.
Event 5 : myfile.txt sub_process_id: rehttr1005 Total Time Taken: 50sec.
i want to display
filename timeTaken
myfile.txt 150sec
Please help me with basic query to add all sub process time.
Assuming you already have the fields extracted with the file name in 'filename' and time taken in 'timeTaken' then this should work.
index=ABC source=trxfxfgf.log | stats sum(timeTaken) as TotalTime by filename
Assuming you already have the fields extracted with the file name in 'filename' and time taken in 'timeTaken' then this should work.
index=ABC source=trxfxfgf.log | stats sum(timeTaken) as TotalTime by filename
Thanks Rich, it helped me a lot