I have the following query:
sourcetype=XXX Some query for * took * seconds to load
And this is a result of query:
I, [2016-09-28T11:01:21.616144 #23942] INFO -- : Some query for authorizations took 8 seconds to load. JobID: 1475060473.4330475
I, [2016-09-28T11:01:21.113586 #20705] INFO -- : Some query for authentications took 9 seconds to load. JobID: 1475060472.4330474
I, [2016-09-28T11:01:20.539219 #19285] INFO -- : Some query for authentications took 8 seconds to load. JobID: 1475060472.4330473
But I need to get average time for each of operation type (authorizations and authentications from example):
authorizations: 8.5
authentications: 8
Is it possible?
Assuming that both operation type and duration is not extracted, try like this
sourcetype=XXX Some query for * took * seconds to load | rex "for (?<operation_type>\w+) took (?<duration>\d+) seconds" | stats avg(duration) as Average_Time by operation_type
Assuming that both operation type and duration is not extracted, try like this
sourcetype=XXX Some query for * took * seconds to load | rex "for (?<operation_type>\w+) took (?<duration>\d+) seconds" | stats avg(duration) as Average_Time by operation_type