Splunk Search

Best way to format out time field for average time

agentguerry
Path Finder

I am using the linux time command to see how long it takes to run a process.

My logs show as runtime=0m0.000s

So example would be runtime=2m47.012s

What is the best way to parse the output that the command "time provides" to be able to get a time chart of the results?

I tried just doing a timechart, but with no results of the actual time above.
index=metrics process=dailybackup
| timechart span=4h avg(runtime)

0 Karma

adonio
Ultra Champion

you are trying to perform a statistical function avg on field that contains strings: 2m47.012s
there are many ways to approach this challenge, here is one using rex and eval to create an integer for seconds:

| makeresults count=1
| eval runtime="2m47.012s,4m4.912s,12m7.020s,0m9.999s,0m0.712s,3m7.012s,14m4.920s,1m17.029s,0m4.880s,0m0.001s"
| makemv delim="," runtime
| mvexpand runtime
| streamstats count as event_count
| eval _time = _time - event_count * 1000
| rename COMMENT as "the above generates data with different time for timechart, below is the solution" 
| rex field=runtime "(?<minutes>\d+)m(?<seconds>\d+).(?<miliseconds>\d+)"
| eval min_to_sec = minutes * 60
| eval mili_to_sec = exact(miliseconds / 1000)
| eval total_runtime_seconds = exact(seconds + min_to_sec + mili_to_sec)
| timechart span=3000s avg(total_runtime_seconds) as avg_run_time

hope it helps

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...