https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12279#M961 <P>I have a field in my Apache logs that's defined as "MicroSeconds". This is the response time in microseconds for a specific call in Apache to our Weblogic back ends.</P> <P>I'm trying to generate a real time chart on the average response times based on the "Microseconds" field. I'd like to be able to convert microseconds to milliseconds so I don't freak out our users when they see a transaction hit 4000..</P> <P>How would I do that? The basic search right now is:</P> <PRE><CODE>index="uat_apache_logs" /pbng | timechart avg(MicroSeconds) </CODE></PRE> <P>which works good..I just need to convert it to milliseconds..</P> <P>Thanks in advance.</P> Tue, 27 Apr 2010 00:53:37 GMT Brian_Osburn 2010-04-27T00:53:37Z https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12279#M961 <P>I have a field in my Apache logs that's defined as "MicroSeconds". This is the response time in microseconds for a specific call in Apache to our Weblogic back ends.</P> <P>I'm trying to generate a real time chart on the average response times based on the "Microseconds" field. I'd like to be able to convert microseconds to milliseconds so I don't freak out our users when they see a transaction hit 4000..</P> <P>How would I do that? The basic search right now is:</P> <PRE><CODE>index="uat_apache_logs" /pbng | timechart avg(MicroSeconds) </CODE></PRE> <P>which works good..I just need to convert it to milliseconds..</P> <P>Thanks in advance.</P> Tue, 27 Apr 2010 00:53:37 GMT https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12279#M961 Brian_Osburn 2010-04-27T00:53:37Z https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12280#M962 <P>You can use the "eval" command to perform operations in field values: <A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval" rel="nofollow">http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval</A></P> <P>In your case:</P> <PRE><CODE>... | timechart avg(MicroSeconds) as avgus | eval avg_milliseconds = avgus/1000 </CODE></PRE> Tue, 27 Apr 2010 01:46:57 GMT https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12280#M962 gkanapathy 2010-04-27T01:46:57Z https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12281#M963 <P>That works. Anyway to make drilldown work with this? I get a "# PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command"</P> <P>Brian</P> Tue, 27 Apr 2010 02:18:05 GMT https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12281#M963 Brian_Osburn 2010-04-27T02:18:05Z https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12282#M964 <P>Answer is disarmingly simple - just do the eval before the timechart instead of after. "eval milliseconds=MicroSeconds*1000 | timechart avg(milliseconds)"</P> Tue, 27 Apr 2010 02:41:20 GMT https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12282#M964 sideview 2010-04-27T02:41:20Z https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12283#M965 <P>How did you define the field in Splunk? I assume you are using the Apache response time option in the log format?</P> <P>Thanks</P> <P>Ed</P> Thu, 26 Apr 2012 20:12:41 GMT https://community.splunk.com/t5/Splunk-Search/How-do-convert-a-field-and-report-on-the-average-response-time/m-p/12283#M965 ebailey 2012-04-26T20:12:41Z