I'm trying to graph the average time of an event:
July 18, 2016 10:02 -> INFO -> Done with sync of project-high-med-2016-spf-1-0_amss_standard_oem_milestone to eurdc of 272 MB in 20.29167366027832 seconds
July 18, 2016 08:16 -> INFO -> Done with sync of shenzhen-hipad-telecommunication-technology-co-ltd/msm8909-la-1-1_amss_oem_milestone-major to tw of 24 MB in 14.404675483703613 seconds
So I want to display the results of average time per region:
eurdc= x seconds
tw= x seconds
Any suggestions?
Try this:
yoursearch | rex "to\s(?<loghost>\w+)\sof\s\d+\sMB\sin\s(?<seconds>\d+\.\d+)\sseconds" | stats avg(seconds) by loghost
Seems to be working, can you explain a little bit the way to form the expression?
The rex command is just extracting the needed fields loghost and seconds from the event logs.
Afterwards the stats command is calculating the needed average (avg) of seconds by loghost.