https://community.splunk.com/t5/Splunk-Search/Eval-and-Status/m-p/57730#M14079 <P>this works</P> <P>index = ili_imaging_index| eval latency =_time - _indextime| stats sum(latency) by host</P> Mon, 28 Sep 2020 12:55:58 GMT peter_gianusso 2020-09-28T12:55:58Z https://community.splunk.com/t5/Splunk-Search/Eval-and-Status/m-p/57729#M14078 <P>I want to get a average of the indexing latency time by host. </P> <P>index = ili_imaging_index| eval latency =_time - _indextime| table avg(latency) by host</P> <P>This is returning useless stuff. This seems so simple!!</P> Mon, 28 Sep 2020 12:55:55 GMT https://community.splunk.com/t5/Splunk-Search/Eval-and-Status/m-p/57729#M14078 peter_gianusso 2020-09-28T12:55:55Z https://community.splunk.com/t5/Splunk-Search/Eval-and-Status/m-p/57730#M14079 <P>this works</P> <P>index = ili_imaging_index| eval latency =_time - _indextime| stats sum(latency) by host</P> Mon, 28 Sep 2020 12:55:58 GMT https://community.splunk.com/t5/Splunk-Search/Eval-and-Status/m-p/57730#M14079 peter_gianusso 2020-09-28T12:55:58Z