https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143708#M39935 <P>Try this</P> <PRE><CODE>index=web_logging sourcetype=web_access | eval GetMyPortalTime=GetMyPortalTime/1000000| timechart avg(GetMyPortalTime) </CODE></PRE> Tue, 15 Jul 2014 18:03:35 GMT somesoni2 2014-07-15T18:03:35Z https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143707#M39934 <P>I have an event that has a value pair called GetMyPortalTime:</P> <UL> <LI>698026 [15/Jul/2014:10:47:40 -0700] "GET /wps/myportal HTTP/1.1" 200 254836 TS:1 WAS:tstgpvwp02.octfcu.org:10053 <STRONG>TIME:1312414</STRONG></LI> </UL> <P>The time:1312414 is microseconds. When I run the following:<BR /> index=web_logging sourcetype=web_access| timechart avg(GetMyPortalTime)</P> <P>the time shows values as:<BR /> 186631.534483<BR /> 145745.235474<BR /> 235465.586456</P> <P>How do I divide these values by 1000000 to covert it to show seconds? I try the following search:<BR /> index=web_logging sourcetype=web_access| timechart avg(GetMyPortalTime/1000000)</P> <P>but it doesn't like it, any suggestions?</P> Mon, 28 Sep 2020 17:04:44 GMT https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143707#M39934 dperry 2020-09-28T17:04:44Z https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143708#M39935 <P>Try this</P> <PRE><CODE>index=web_logging sourcetype=web_access | eval GetMyPortalTime=GetMyPortalTime/1000000| timechart avg(GetMyPortalTime) </CODE></PRE> Tue, 15 Jul 2014 18:03:35 GMT https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143708#M39935 somesoni2 2014-07-15T18:03:35Z https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143709#M39936 <P>Are you sure that's in milliseconds? Dividing by 1,000,000 suggests microseconds.</P> Tue, 15 Jul 2014 18:07:50 GMT https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143709#M39936 martin_mueller 2014-07-15T18:07:50Z https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143710#M39937 <P>my apologies, it is microseconds</P> Tue, 15 Jul 2014 18:12:58 GMT https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143710#M39937 dperry 2014-07-15T18:12:58Z https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143711#M39938 <P>This worked! Thank you</P> Tue, 15 Jul 2014 18:17:56 GMT https://community.splunk.com/t5/Splunk-Search/Divide-a-value-of-microseconds-to-seconds/m-p/143711#M39938 dperry 2014-07-15T18:17:56Z