Hi,
I'm trying to create a table that shows me the number of times a URL is requested for and what its average response time is (for a given time period).
The events that contain the relevant information (url path, response time) look like this:
2014-07-02 16:04:26,716 INFO 8767 --- [p-1328426564-28] user=[ ] a.c.n.a.a.c.filters.RequestTimingFilter : Returning statusCode=[200] after time=[19ms] for method=[GET] path=[/atlas/v1/assets/adhoc/fsam/2LJT-07] queryString=[] userDn=[uid=GRAHAMHISCOCK,ou=internal users,ou=nbn,dc=nbnco,dc=com,dc=au]
In the above example, the url path is "/atlas/v1/assets/adhoc/fsam/2LJT-07" and the response time is 19 milliseconds.
The search I used is this:
path v1 | rex field=_raw "time=\[(?<responsetime>.*?)ms\]" | stats count,avg(num(responsetime)) by path
However, this seems to show me only the path and count, not average response time (this field is blank)
path count avg(num(responsetime))
[/atlas/v1/status/health] 46
[/atlas/v1/boundaries/fsam] 18
[/atlas/v1/assets/adhoc/fsam/2BLK-01] 17
Any ideas how I can obtain this information?
Thanks in advance.
Hans
Why use any function at all? responsetime
should already be numeric if correctly extracted. If it's not correctly extracted, then that's the problem that needs to be solved.
so, now you're able to accept this as the answer 😉
Yup that fixed it 🙂 ...No need to use 'num' or 'tonumber' as its already a number!
Just tried the same search with 'tonumber' instead of 'num'. Still has the same problem.
shouldn't this avg(num(responsetime))
be like avg(tonumber(responsetime))
?