Refine your search:

for example, i have the following 7 logs,

2011-DEC-17 slotid="Location-Maps-US-Sunnyvale" delta_msec="1487" seq="3"

2011-DEC-17 slotid="Location-Maps-US-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Maps-US-SF" delta_msec="1465" seq="2"

2011-DEC-17 slotid="Location-Store-CA-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Store-CA-SF" delta_msec="1245" seq="2"

2011-DEC-17 slotid="Location-Msg-CA-MountainView" delta_msec="1445" seq="2"

2011-DEC-17 slotid="Location-Msg-CA-SF" delta_msec="1245" seq="2"

i want to calculate a new field(avg_msec) based on the "slotid" we would like to calculate an average for all logs matching "Location-Maps" we would like to calculate an average for all logs matching "Location-Store" we would like to calculate an average for all logs matching "Location-Msg"

Can somebody help write the search string? Thanks!

asked 20 Dec '11, 14:05

xiaoyuew's gravatar image

xiaoyuew
276
accept rate: 33%

edited 20 Dec '11, 14:05


One Answer:

Hi there,

Something along the lines of;

...|rex field=slotid "Location-(?<ZZZZ>[^-]+)-" | stats avg(delta_msec) AS avg_msec by ZZZZ

this should extract "Maps", "Store" and "Msg" into a new field called ZZZZ, which you subsequently can run ordinary stats commands on.

Hope this helps,

Kristian

link

answered 21 Dec '11, 03:07

kristian.kolb's gravatar image

kristian.kolb
9.9k615
accept rate: 33%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×22
×15

Asked: 20 Dec '11, 14:05

Seen: 720 times

Last updated: 21 Dec '11, 03:07

Copyright © 2005-2012 Splunk Inc. All rights reserved.