https://community.splunk.com/t5/Splunk-Search/Average-duration-in-Timechart/m-p/549355#M155872 <P>stats will reduce your pipeline of events to min_t, max_t and uniqueId - there is no _time field remaining in the events, so timechart has nothing to work with (timechart expects _time to be present in the events). You should probably select one of the times to be used for _time</P><LI-CODE lang="markup">index= ... | stats min(_time) as min_t max(_time) as _time by uniqueId | eval duration = (_time - min_t)* 1000 | timechart span=24h avg(duration) as AvgDur</LI-CODE><P>&nbsp;</P> Mon, 26 Apr 2021 16:16:29 GMT ITWhisperer 2021-04-26T16:16:29Z https://community.splunk.com/t5/Splunk-Search/Average-duration-in-Timechart/m-p/549343#M155867 <P>Hello, new to Splunk and would appreciate some guidance.&nbsp;</P><P>I want to create a timechart query to use for a dashboard to display the average response time over 24h as a trend. This is what I have so far:&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">index= ... | stats min(_time) as min_t max(_time) as max_t by uniqueId | eval duration = (max_t - min_t)* 1000 | timechart span=24h avg(duration) as AvgDur</LI-CODE><P>&nbsp;</P><P>This returns an empty table as a response with no average duration values. If I return just before the timechart command, I get a table with all my log responses with the correct duration.&nbsp;</P><P>Could I get some guidance on why timechart isn't returning the average durations over 24h?</P><P>&nbsp;</P><P>&nbsp;</P> Mon, 26 Apr 2021 14:29:09 GMT https://community.splunk.com/t5/Splunk-Search/Average-duration-in-Timechart/m-p/549343#M155867 cclva 2021-04-26T14:29:09Z https://community.splunk.com/t5/Splunk-Search/Average-duration-in-Timechart/m-p/549355#M155872 <P>stats will reduce your pipeline of events to min_t, max_t and uniqueId - there is no _time field remaining in the events, so timechart has nothing to work with (timechart expects _time to be present in the events). You should probably select one of the times to be used for _time</P><LI-CODE lang="markup">index= ... | stats min(_time) as min_t max(_time) as _time by uniqueId | eval duration = (_time - min_t)* 1000 | timechart span=24h avg(duration) as AvgDur</LI-CODE><P>&nbsp;</P> Mon, 26 Apr 2021 16:16:29 GMT https://community.splunk.com/t5/Splunk-Search/Average-duration-in-Timechart/m-p/549355#M155872 ITWhisperer 2021-04-26T16:16:29Z