What is the syntax to obtain the average duration for each severity type in a query? A field exists called app_duration=0d 0h 40m 3s. I need the average for each severity type.
Thanks.
First convert the app_duration
to a format convert can use. Then, use convert to store app_duration
in seconds. Next, average all seconds by severity_type
. Finally, re-format avg_app_duration
for each severity_type
in the human readable format of HH:MM:SS.
eval app_duration=replace(replace(replace(app_duration,"d\s","+"),"h|m|s",""),"\s",":")
| convert dur2sec(app_duration)
| stats avg(app_duration) as avg_app_duration by severity_type
| eval avg_app_duration=tostring(round(avg_app_duration,0),"duration")
First convert the app_duration
to a format convert can use. Then, use convert to store app_duration
in seconds. Next, average all seconds by severity_type
. Finally, re-format avg_app_duration
for each severity_type
in the human readable format of HH:MM:SS.
eval app_duration=replace(replace(replace(app_duration,"d\s","+"),"h|m|s",""),"\s",":")
| convert dur2sec(app_duration)
| stats avg(app_duration) as avg_app_duration by severity_type
| eval avg_app_duration=tostring(round(avg_app_duration,0),"duration")