In my log file, I have lot of messages saying upload or search got completed in x seconds. Like -
Search Completed successfully in 0.698 seconds
Upload Completed successfully in 2.529 seconds
We need a report that tells us the total count on hourly basis but with it it should also calculate Min/Max/Avg time (second) spent for in each of that operation. Result should be like -
Activity Count Min Max Avg
Upload
Search
Assuming you have no existing extractions, something like this should get you started.
index = foo | rex "(?P<Activity>\w+) Completed successfully in (?P<secs>\d+\.\d+) seconds" | stats count(secs) as Count min(secs) as Min max(secs) as Max avg(secs) as Avg by Activity | table Activity Count Min Max Avg