Getting min, max, avg etc on runtimes
Answered
Hi, I have log files that show total runtime in them as hours, minutes and seconds. I need some help to be able to get something useful from them.
I have the following query right now:
(sourcecategory=prod_lavastorm and "Elapsed Time is: ")
| parse regex field=_sourceName "\/(?<graph>[^\/]+)_PRODUCTION\d+" nodrop
| parse regex "Elapsed Time is: (?<run_time_string>.*\n)" multi
| parse regex field=run_time_string "Minutes - (?<seconds>\d+) Seconds" nodrop
| parse regex field=run_time_string "Hours - (?<minutes>\d+) Minutes" nodrop
| parse regex field=run_time_string "(?<hours>\d+) Hours" nodrop
| hours*3600 + minutes*60 + seconds as runtime
Could anyone help to get it per graph (note this is a term for process)
Essentially i'm looking to trend over time if a process is taking longer and once I have this i'm going to look at outliers too
-
Hi Wayne,
Here's what I have for your as a 1st step to validate that this is the direction you would like to go.
_sourcecategory=prod_lavastorm "Elapsed Time is: "
| timeslice 15m //this will be used for trending over time
| parse "Elapsed Time is: * Hours - * Minutes - * Seconds" as Hours,Minutes,Seconds //using "Parse Anchor" we can condense the number of parse statements
| parse regex field=_sourceName "\/(?<graph>[^\/]+)/PRODUCTION" nodrop //a couple changes were made to extract what I believe is the "graph" you desire
| (Hours*3600) + (Minutes*60) + Seconds as runtime //using the * will give us the multiplication you desire
| avg(runtime) by graph, _timeslice //avg will average the runtimes by graph over each timeslice
| transpose row _timeslice column graph //transpose puts it into a table formatYou can run this using the following link => https://service.sumologic.com/ui/#section/search/clMhIE6RhNxuJvno8ueqyqigKZ4v9D3RwivJprUQ
Finally, I added it to a live dashboard called "Runtime" that is published under the Sumo Logic Support Account.
Please review and then let me know how we can move closer to covering all the information you desire.
Please sign in to leave a comment.
Comments
2 comments