Splunk Search

Calculate avg task duration

snabi
Explorer

Thanks in advance...

- My server log contains the following

xxxxxxxx|xx -> Finished embeding fallback task 00:01:00.0004165

xxxxxxxx|xx -> Finished embeding fallback task 00:00:49.0004062

  • My goal is to calculate average time spent in seconds on these tasks over last couple hours

Out-put should look like : ** (AVG) embeding fallback duration 54.50041135**

SPLUNK query attempted : Not working......

"Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.\d+)" |eval duration=strptime(embeding_fallback_task_duration,"%H:%M:%S")| eval base=strptime("00:00:00.00","%H:%M:%S") | eval secs=duration-base | stats avg(duration) as "(AVG) embeding fallback duration"

Tags (4)
0 Karma

snabi
Explorer

Thank you.... found a fix

"Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.\d+):(?.\d+):(?.\d+).(?.\d+)" | eval embeding_fallback_task_duration = ((hours*60*60)+(minutes*60)+seconds+(subSeconds/1000000)) | stats avg(embeding_fallback_task_duration)

For...
Finished embeding fallback task 00:00:00.1918088
Finished embeding fallback task 00:00:00.1136647

Out put...
avg(embeding_fallback_task_duration)
0.152737

0 Karma

MuS
SplunkTrust
SplunkTrust

Because your regex will only match the 00:00:00 hours:minute:seconds numbers and none of the .subsecond numbers

0 Karma

snabi
Explorer

This seems to be working...

"Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.\d+):(?.\d+):(?.\d+)" | eval embeding_fallback_task_duration = ((hours*60*60)+(minutes*60)+seconds) | timechart avg(embeding_fallback_task_duration)

But ..why my output shows 0.00000 ... for following logs?

Finished embeding fallback task 00:00:00.1284716
Finished embeding fallback task 00:00:00.1496968

Out-put i am getting...
avg(embeding_fallback_task_duration)
0.000000

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are your duarion and secs fields calculated correctly before the stats?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think your stats avg(duration) should be stats avg(secs).

---
If this reply helps you, Karma would be appreciated.
0 Karma

snabi
Explorer

Thanks for the correction.....still not returning any output..

Finished embeding fallback task*" sourcetype="Doctrackr" index="staging2" | rex field=_raw "Finished embeding fallback task (?.d+)" |eval duration=strptime(embeding_fallback_task_duration,"%H:%M:%S")| eval base=strptime("00:00:00.00","%H:%M:%S") | eval secs=duration-base | stats avg(secs) as "(AVG) embeding fallback duration"

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...