i want to convert it to
i want this fields
Average overtime
Max value overtime
min value overtime
Give this a try
your base search | rex field="ActualTime" "(?<sec>\d+) second (?<millisec>\d+) millisec (?<microsec>\d+) microsec (?<nanosec>\d+) nanosec" | eval ActualTime=round(sec+(millisec/1000)+(microsec/1000000)+(nanosec/1000000000),9)
You can than add appropriate aggregation commands per your need. E.g.
your base search | rex field="ActualTime" "(?<sec>\d+) second (?<millisec>\d+) millisec (?<microsec>\d+) microsec (?<nanosec>\d+) nanosec" | eval ActualTime=round(sec+(millisec/1000)+(microsec/1000000)+(nanosec/1000000000),9) | stats avg(ActualTime) as "Average overtime" max(ActualTime) as "Max value overtime" min(ActualTime) as "min value overtime"
Give this a try
your base search | rex field="ActualTime" "(?<sec>\d+) second (?<millisec>\d+) millisec (?<microsec>\d+) microsec (?<nanosec>\d+) nanosec" | eval ActualTime=round(sec+(millisec/1000)+(microsec/1000000)+(nanosec/1000000000),9)
You can than add appropriate aggregation commands per your need. E.g.
your base search | rex field="ActualTime" "(?<sec>\d+) second (?<millisec>\d+) millisec (?<microsec>\d+) microsec (?<nanosec>\d+) nanosec" | eval ActualTime=round(sec+(millisec/1000)+(microsec/1000000)+(nanosec/1000000000),9) | stats avg(ActualTime) as "Average overtime" max(ActualTime) as "Max value overtime" min(ActualTime) as "min value overtime"
| rex "ActualTime=\s(?[^|]*)\"" | rex field="ActualTime" "(?\d+) second (?\d+) millisec (?\d+) microsec (?\d+) nanosec" | eval ActualTime=round(sec+(millisec/1000)+(microsec/1000000)+(nanosec/1000000000),9)
it working for me thanks
Hi sravankaripe,
did you tried with the round function?
| eval ActualTime=round(ActualTime,0)
after you can calculate avg, max and min
| stats avg(ActualTime) AS avg max(ActualTime) AS max min(ActualTime) AS min
Bye.
Giuseppe
In above img ActualTime i extracted through rex.
So, the result which you gave not working for me.