<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic timechart with math function in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/timechart-with-math-function/m-p/82067#M20829</link>
    <description>&lt;P&gt;i am using timechart like this&lt;/P&gt;

&lt;P&gt;search | timechart span=10m avg(diff)&lt;/P&gt;

&lt;P&gt;but the diff number is in seconds I would like the answer in minutes like this&lt;/P&gt;

&lt;P&gt;search | timechart span=10m avg(diff)/60&lt;/P&gt;

&lt;P&gt;this doesn't work&lt;/P&gt;

&lt;P&gt;Anyone have a suggestion??&lt;/P&gt;</description>
    <pubDate>Tue, 02 Apr 2013 16:04:18 GMT</pubDate>
    <dc:creator>hartfoml</dc:creator>
    <dc:date>2013-04-02T16:04:18Z</dc:date>
    <item>
      <title>timechart with math function</title>
      <link>https://community.splunk.com/t5/Splunk-Search/timechart-with-math-function/m-p/82067#M20829</link>
      <description>&lt;P&gt;i am using timechart like this&lt;/P&gt;

&lt;P&gt;search | timechart span=10m avg(diff)&lt;/P&gt;

&lt;P&gt;but the diff number is in seconds I would like the answer in minutes like this&lt;/P&gt;

&lt;P&gt;search | timechart span=10m avg(diff)/60&lt;/P&gt;

&lt;P&gt;this doesn't work&lt;/P&gt;

&lt;P&gt;Anyone have a suggestion??&lt;/P&gt;</description>
      <pubDate>Tue, 02 Apr 2013 16:04:18 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/timechart-with-math-function/m-p/82067#M20829</guid>
      <dc:creator>hartfoml</dc:creator>
      <dc:date>2013-04-02T16:04:18Z</dc:date>
    </item>
    <item>
      <title>Re: timechart with math function</title>
      <link>https://community.splunk.com/t5/Splunk-Search/timechart-with-math-function/m-p/82068#M20830</link>
      <description>&lt;P&gt;Before creating your timechart, use an eval function to format your variable the way you would like. So try something like:&lt;/P&gt;

&lt;P&gt;search | eval diff_in_min=(diff/60) | timechart span=10m avg(diff_in_min)&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 13:39:12 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/timechart-with-math-function/m-p/82068#M20830</guid>
      <dc:creator>BenjaminWyatt</dc:creator>
      <dc:date>2020-09-28T13:39:12Z</dc:date>
    </item>
    <item>
      <title>Re: timechart with math function</title>
      <link>https://community.splunk.com/t5/Splunk-Search/timechart-with-math-function/m-p/82069#M20831</link>
      <description>&lt;P&gt;thanks much&lt;/P&gt;</description>
      <pubDate>Tue, 02 Apr 2013 16:31:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/timechart-with-math-function/m-p/82069#M20831</guid>
      <dc:creator>hartfoml</dc:creator>
      <dc:date>2013-04-02T16:31:54Z</dc:date>
    </item>
    <item>
      <title>Re: timechart with math function</title>
      <link>https://community.splunk.com/t5/Splunk-Search/timechart-with-math-function/m-p/82070#M20832</link>
      <description>&lt;P&gt;A simpler way may be to use eval() (as function): &lt;BR /&gt;
&lt;CODE&gt;search | timechart span=10m eval(avg(diff)/60) as diff_in_min&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 31 Aug 2015 15:57:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/timechart-with-math-function/m-p/82070#M20832</guid>
      <dc:creator>oaustegard</dc:creator>
      <dc:date>2015-08-31T15:57:21Z</dc:date>
    </item>
  </channel>
</rss>

