Hi Team,
Currently I am using below query to show duration:
index="abc*" sourcetype=600000304_gg_abs_ipc2 | rex "\[(?<thread>Thread[^\]]+)\]"
| transaction thread startswith=" Started ASSOCIATION process for" endswith="Successfully completed ASSOCIATION process"
| timechart avg(duration) as duration span=1d
| eval duration=tostring(duration, "duration")|sort _time
I am getting output as below:
I want to see duration in minutes only Can someone guide me.
Duration is in seconds so divide by 60 to get minutes.
index="abc*" sourcetype=600000304_gg_abs_ipc2 | rex "\[(?<thread>Thread[^\]]+)\]"
| transaction thread startswith=" Started ASSOCIATION process for" endswith="Successfully completed ASSOCIATION process"
| timechart avg(duration) as duration span=1d
| eval duration=floor(duration/60)|sort _time
Duration is in seconds so divide by 60 to get minutes.
index="abc*" sourcetype=600000304_gg_abs_ipc2 | rex "\[(?<thread>Thread[^\]]+)\]"
| transaction thread startswith=" Started ASSOCIATION process for" endswith="Successfully completed ASSOCIATION process"
| timechart avg(duration) as duration span=1d
| eval duration=floor(duration/60)|sort _time