Hi All,
After doing some search, I got output as
x avg median
2017-01-11 12:16:00,[Process],D:\Program Files\local.Log 3 5
The output I need should be like
x avg median
2017-01-11 12:16:00,
[Process],
D:\Program Files\local.Log 3 5
Thanks.
Here is the search:
index=abs (source=*log*)
| rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\"
|eval seconds=(seconds/1000)
|eval seconds=coalesce(seconds,us)
| eval source=replace(source,"\d+\.log$",".log")
| table _time sourceMETHOD seconds
| bin _time span=1m
|eval _time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|eval x=_time.",".METHOD.",".source
| stats median(seconds) as median by x source METHOD
| search METHOD="[Process]"
|eventstats count as Linecount sum(median) as Total
|eval average=Total/Linecount
|fields x average median
When you pasted your search into the comment, it lost some information. The rex commands don't make any sense now - but I have copied them here. This should work
index=abs source=*log*
| rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\"
| search METHOD="[Process]"
| eval seconds=(seconds/1000)
| eval seconds=coalesce(seconds,us)
| eval source=replace(source,"\d+\.log$",".log")
| bin span=1m _time
| eval x = strftime(_time,"%x %X") . "\n" . METHOD . "\n" . source
| stats median(seconds) as median by x
| eventstats count as Linecount sum(median) as Total
| eval average=Total/Linecount
| fields x average median
Although it seems to me that METHOD is not really needed at all, since you have filtered to show only the Process method. And I am a bit uncomfortable with the calculation of average: in the eventstats command, as count
will be only a count of the number of stats results, not the count of events returned by the search. I did a couple of things to make the search more efficient.
What is the difference in these two outputs? single line vs multiline?? If that is the case, try this
your current search giving fields x, average, median | makemv x delim=","
@venkatesh296 - Can you provide the search that you used? That would be helpful for users attempting to assist you in how you got your initial output and how you want your output to look like.
In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible. Thanks.
index=abs (source=*log*) | rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\" |eval seconds=(seconds/1000)|eval seconds=coalesce(seconds,us)| eval source=replace(source,"\d+\.log$",".log")| table _time sourceMETHOD seconds | bin _time span=1m |eval _time=strftime(_time,"%Y-%m-%d %H:%M:%S")|eval x=_time.",".METHOD.",".source| stats median(seconds) as median by x source METHOD | search METHOD="[Process]"|eventstats count as Linecount sum(median) as Total|eval average=Total/Linecount|fields x average median
@venkatesh296 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.