https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-avg-time-of-transactions-where-the-duration/m-p/308882#M92625 <P>Hi! I'm trying to get the avg time of transactions where the duration is longer than normal. I can successfully do what I want in a appendcols clause, but it feels like hard work for something simple. The appendcols is added at the end to show you what I wanted to do.</P> <PRE><CODE>index=ourindex APIRequestStart OR APIRequestStop | transaction uuid startswith="* - APIRequestStart" endswith="* - APIRequestStop" | timechart count(eval(duration&gt;2)) AS "Number Slow Transactions", **avg(eval(duration&gt;2)) AS "Avg Slow Transactions"**, count AS "Total Transactions", avg(duration) AS "Avg Transactions" span=1h | appendcols [search index=index_cesoa* APIRequestStart OR APIRequestStop | transaction uuid startswith="* - APIRequestStart" endswith="* - APIRequestStop" | where duration &gt; 2 | timechart avg(duration) AS "Working Avg Slow Transactions" span=1h] </CODE></PRE> Tue, 17 Oct 2017 00:54:18 GMT WarpedMonkey 2017-10-17T00:54:18Z https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-avg-time-of-transactions-where-the-duration/m-p/308882#M92625 <P>Hi! I'm trying to get the avg time of transactions where the duration is longer than normal. I can successfully do what I want in a appendcols clause, but it feels like hard work for something simple. The appendcols is added at the end to show you what I wanted to do.</P> <PRE><CODE>index=ourindex APIRequestStart OR APIRequestStop | transaction uuid startswith="* - APIRequestStart" endswith="* - APIRequestStop" | timechart count(eval(duration&gt;2)) AS "Number Slow Transactions", **avg(eval(duration&gt;2)) AS "Avg Slow Transactions"**, count AS "Total Transactions", avg(duration) AS "Avg Transactions" span=1h | appendcols [search index=index_cesoa* APIRequestStart OR APIRequestStop | transaction uuid startswith="* - APIRequestStart" endswith="* - APIRequestStop" | where duration &gt; 2 | timechart avg(duration) AS "Working Avg Slow Transactions" span=1h] </CODE></PRE> Tue, 17 Oct 2017 00:54:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-avg-time-of-transactions-where-the-duration/m-p/308882#M92625 WarpedMonkey 2017-10-17T00:54:18Z https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-avg-time-of-transactions-where-the-duration/m-p/308883#M92626 <P>can you do this instead:</P> <PRE><CODE>index=ourindex APIRequestStart OR APIRequestStop | transaction uuid startswith=" - APIRequestStart" endswith=" - APIRequestStop" |eval durationGT2=if(duration&gt;2,duration,null()) | timechart count(durationGT2) AS "Number Slow Transactions", avg(durationGT2) AS "Avg Slow Transactions", count AS "Total Transactions", avg(duration) AS "Avg Transactions" span=1h </CODE></PRE> <P>just add an eval to grab the durations you're looking for</P> Tue, 17 Oct 2017 11:45:07 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-avg-time-of-transactions-where-the-duration/m-p/308883#M92626 cmerriman 2017-10-17T11:45:07Z https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-avg-time-of-transactions-where-the-duration/m-p/308884#M92627 <P>Perfect! I knew it was dead easy. Thanks a lot!</P> Tue, 17 Oct 2017 13:39:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-avg-time-of-transactions-where-the-duration/m-p/308884#M92627 WarpedMonkey 2017-10-17T13:39:26Z