Finding avg response time using splunk query

Question

I have a log line stating

Received App information from Source and processed in ms: 467

Now I would like to find the avg response time for the app which would be avg values for the time received after ms: Can you please guide me how do I extract the value of time (ms) and then find average response time

Answer 1

You can use Splunk's rex command to extract new fields at search time.

Next, you will need to use the stats command along with the avg function to get the average response time over all events.

Here is the full Splunk query:

| makeresults | eval _raw="Received App information from Source and processed in ms: 467"
| rex field=_raw "processed in ms:\s+(?<response_time>\d+)"
| stats avg(response_time)