<p>I have a log line stating</p>
<p>Received App information from Source and processed in ms: 467</p>
<p>Now I would like to find the avg response time for the app which would be avg values for the time received after ms: Can you please guide me how do I extract the value of time (ms) and then find average response time</p>

knowledge20
<p>You can use Splunk's <a href="https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Rex" rel="nofollow noreferrer">rex command</a> to extract new fields at search time.</p>
<p>Next, you will need to use the <a href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats" rel="nofollow noreferrer">stats command</a> along with the <code>avg</code> function to get the average response time over all events.</p>
<p>Here is the full Splunk query:</p>
<pre><code>| makeresults | eval _raw=&quot;Received App information from Source and processed in ms: 467&quot;
| rex field=_raw &quot;processed in ms:\s+(?&lt;response_time&gt;\d+)&quot;
| stats avg(response_time)
</code></pre>
<p><a href="https://i.stack.imgur.com/FIFAv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/FIFAv.png" alt="screenshot" /></a></p>
