Getting min, max, avg etc on runtimes




  • Avatar
    Colin Corstorphine

    Hi Wayne,

    Here's what I have for your as a 1st step to validate that this is the direction you would like to go.

    _sourcecategory=prod_lavastorm "Elapsed Time is: "
    | timeslice 15m //this will be used for trending over time
    | parse "Elapsed Time is: * Hours - * Minutes - * Seconds" as Hours,Minutes,Seconds //using "Parse Anchor" we can condense the number of parse statements
    | parse regex field=_sourceName "\/(?<graph>[^\/]+)/PRODUCTION" nodrop //a couple changes were made to extract what I believe is the "graph" you desire
    | (Hours*3600) + (Minutes*60) + Seconds as runtime //using the * will give us the multiplication you desire
    | avg(runtime) by graph, _timeslice //avg will average the runtimes by graph over each timeslice
    | transpose row _timeslice column graph //transpose puts it into a table format

    You can run this using the following link =>

    Finally, I added it to a live dashboard called "Runtime" that is published under the Sumo Logic Support Account.

    Please review and then let me know how we can move closer to covering all the information you desire.

    Comment actions Permalink
  • Avatar
    Wayne Taylor

    this is awesome. Thanks

    Comment actions Permalink

Please sign in to leave a comment.