Average duration in Timechart

[cclva]

Hello, new to Splunk and would appreciate some guidance. 

I want to create a timechart query to use for a dashboard to display the average response time over 24h as a trend. This is what I have so far: 

index= ... 
| stats min(_time) as min_t max(_time) as max_t by uniqueId
| eval duration = (max_t - min_t)* 1000
| timechart span=24h avg(duration) as AvgDur

This returns an empty table as a response with no average duration values. If I return just before the timechart command, I get a table with all my log responses with the correct duration. 

Could I get some guidance on why timechart isn't returning the average durations over 24h?

[ITWhisperer · Accepted solution]

stats will reduce your pipeline of events to min_t, max_t and uniqueId - there is no _time field remaining in the events, so timechart has nothing to work with (timechart expects _time to be present in the events). You should probably select one of the times to be used for _time

index= ... 
| stats min(_time) as min_t max(_time) as _time by uniqueId
| eval duration = (_time - min_t)* 1000
| timechart span=24h avg(duration) as AvgDur