Splunk Search

Divide a value of microseconds to seconds

dperry
Communicator

I have an event that has a value pair called GetMyPortalTime:

  • 698026 [15/Jul/2014:10:47:40 -0700] "GET /wps/myportal HTTP/1.1" 200 254836 TS:1 WAS:tstgpvwp02.octfcu.org:10053 TIME:1312414

The time:1312414 is microseconds. When I run the following:
index=web_logging sourcetype=web_access| timechart avg(GetMyPortalTime)

the time shows values as:
186631.534483
145745.235474
235465.586456

How do I divide these values by 1000000 to covert it to show seconds? I try the following search:
index=web_logging sourcetype=web_access| timechart avg(GetMyPortalTime/1000000)

but it doesn't like it, any suggestions?

Tags (3)
1 Solution

somesoni2
Revered Legend

Try this

index=web_logging sourcetype=web_access | eval GetMyPortalTime=GetMyPortalTime/1000000| timechart avg(GetMyPortalTime)

View solution in original post

dperry
Communicator

my apologies, it is microseconds

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you sure that's in milliseconds? Dividing by 1,000,000 suggests microseconds.

0 Karma

somesoni2
Revered Legend

Try this

index=web_logging sourcetype=web_access | eval GetMyPortalTime=GetMyPortalTime/1000000| timechart avg(GetMyPortalTime)

View solution in original post

dperry
Communicator

This worked! Thank you

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!