I have an event that has a value pair called GetMyPortalTime:
The time:1312414 is microseconds. When I run the following:
index=web_logging sourcetype=web_access| timechart avg(GetMyPortalTime)
the time shows values as:
186631.534483
145745.235474
235465.586456
How do I divide these values by 1000000 to covert it to show seconds? I try the following search:
index=web_logging sourcetype=web_access| timechart avg(GetMyPortalTime/1000000)
but it doesn't like it, any suggestions?
Try this
index=web_logging sourcetype=web_access | eval GetMyPortalTime=GetMyPortalTime/1000000| timechart avg(GetMyPortalTime)
my apologies, it is microseconds
Are you sure that's in milliseconds? Dividing by 1,000,000 suggests microseconds.
Try this
index=web_logging sourcetype=web_access | eval GetMyPortalTime=GetMyPortalTime/1000000| timechart avg(GetMyPortalTime)
This worked! Thank you