Hi @krusovice,
try this:
...|rex field="DURATION" "(?<DURATION>\d+)"
|eventstats avg(DURATION) as average
|eval average=round(average,1)." seconds"
Try this run anywhere search:
|makeresults|eval REQUEST="AAA", DURATION="40 seconds"
|append[|makeresults|eval REQUEST="BBB", DURATION="20 seconds"]
|append[|makeresults|eval REQUEST="CCC", DURATION="50 seconds"]
|rex field="DURATION" "(?<DURATION>\d+)"
|eventstats avg(DURATION) as average
|eval average=round(average,1)." seconds"
Hey krusovoice,
You can try this run anywhere query:
| makeresults | eval Request="AAA BBB CCC" | makemv Request| mvexpand Request | appendcols [| makeresults | eval ID="1122 3344 5566" | makemv ID| mvexpand ID ] | appendcols [| makeresults | eval Duration="40seconds 50seconds 20seconds" | makemv Duration| mvexpand Duration ] |rex field=Duration "(?P<Dur>\d+)"| eventstats avg(Dur) AS avgDur
OR you can add this to your query:
|rex field=Duration "(?P\d+)"| eventstats avg(Dur) AS avgDur
Let me know if this helps!!
Hi deepashri_123,
eventstats just make the trick! Thank you as always.
@krusovice,
Please Upvote the answer if that helped!!
Thanks!!
Hi @krusovice,
try this:
...|rex field="DURATION" "(?<DURATION>\d+)"
|eventstats avg(DURATION) as average
|eval average=round(average,1)." seconds"
Try this run anywhere search:
|makeresults|eval REQUEST="AAA", DURATION="40 seconds"
|append[|makeresults|eval REQUEST="BBB", DURATION="20 seconds"]
|append[|makeresults|eval REQUEST="CCC", DURATION="50 seconds"]
|rex field="DURATION" "(?<DURATION>\d+)"
|eventstats avg(DURATION) as average
|eval average=round(average,1)." seconds"
Thank you @493669 for the great helps! It's work well in my dashboard.