Graph hourly events multiplied by avgevent duration (in hours),

[c799651]

Hi I have data with captures events (phone calls). I would like to graph in hourly buckets the total calls per hour multiplied by the avg call duration.

I have fumbled around and been able to present the two components in separate charts but failed when trying to merge both charts into one with the multiplication performed.

First Search

index=mydata sourcetype=cer
| bin _time span=1h
| eval date_hour=strftime(_time, "%H")
| stats count AS B_Number first(date_hour) AS date_hour BY _time
| stats avg(B_Number) BY date_hour

Second Search.

index=mydata sourcetype=cer
| bin _time span=1h
| eval date_hour=strftime(_time, "%H") | eval Callhours=CallDurationSecs/3600
| stats avg(Callhours) BY date_hour

How do I combine these searches with the muliplication applied.
Eg Search 1 Hour 1 result equals .00112299
Search 1 Hour 1 result equals 35555
Desired result for hour 1 399.21 (.00112299*35555)

[c799651]

Thanks very much this worked. But when I used "visualisation" Splunk is graphing A, B and result by hour.
How do I just show result by Hour in the column chart?

Thanks Again

[c799651]

think I worked it out. Just added

| stats avg(result) by date_hour

[to4kawa · Accepted solution]

index=mydata sourcetype=cer
| eval Callhours=CallDurationSecs/3600
| timechart span=1h count as B_Number avg(Callhours) as Callhours values(eval(strftime(_time, "%H"))) AS date_hour

and

| stats avg(B_Number) as A avg(Callhours) as B BY date_hour
| eval result= A * B

I don't know your time range, logs. I guess stats maybe works