https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403152#M168712 <P>maybe like this:</P> <PRE><CODE>| transaction node startswith="up_or_down=down" endswith="up_or_down=available" | stats avg(duration) as avg_outage by node | eval rounded_avg_outage = round(avg_outage, 2) | eval MTTR = tostring(rounded_avg_outage, "duration) | table node MTTR </CODE></PRE> <P>hope it helps</P> Tue, 26 Jun 2018 00:46:59 GMT adonio 2018-06-26T00:46:59Z https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403149#M168709 <P>Does anyone know how to round a time readout from 00:07:06.53846153846155 to 00:07:06.54?</P> Mon, 25 Jun 2018 15:37:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403149#M168709 heybails88 2018-06-25T15:37:22Z https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403150#M168710 <P>What is the format of the underlying field? There are at least five different ways, but the efficiency will be based on the field format.</P> Mon, 25 Jun 2018 16:51:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403150#M168710 DalJeanis 2018-06-25T16:51:52Z https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403151#M168711 <P>Thanks for the response</P> <P>Here's the base of the search with MTTR is the mean time to repair or average outage time averaged by duration. The "avg_outage" is epoch:</P> <P>| transaction node startswith="up_or_down=down" endswith="up_or_down=available"<BR /> | stats avg(duration) as avg_outage by node<BR /> | eval MTTR=tostring(avg_outage, "duration") <BR /> | table node MTTR</P> Tue, 29 Sep 2020 20:09:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403151#M168711 heybails88 2020-09-29T20:09:07Z https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403152#M168712 <P>maybe like this:</P> <PRE><CODE>| transaction node startswith="up_or_down=down" endswith="up_or_down=available" | stats avg(duration) as avg_outage by node | eval rounded_avg_outage = round(avg_outage, 2) | eval MTTR = tostring(rounded_avg_outage, "duration) | table node MTTR </CODE></PRE> <P>hope it helps</P> Tue, 26 Jun 2018 00:46:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403152#M168712 adonio 2018-06-26T00:46:59Z https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403153#M168713 <P>Excellent!! That worked. I appreciate it.</P> Tue, 26 Jun 2018 13:03:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-round-a-millisecond-output/m-p/403153#M168713 heybails88 2018-06-26T13:03:03Z