Does timechart span have an effect on computation of avg(duration)?

[NK_1]

Using Splunk 4.1.7

[searchstring...] earliest=09/23/2012:09:00:00 latest=09/23/2012:10:00:00 AccountID | transaction AccountID startsWith="Transaction Begin" endswith="Transaction End" keepevicted=false | timechart avg(duration) span=10m

As I increase the value for span, the avg(duration) seems to increase.

Is this the way it is supposed to work?

[Ayn · Accepted solution]

If you increase the span and that has the effect that events with higher values for duration are then included in the span, then yes. Other than that, the span parameter has no effect in itself on whether the average goes up or down - the average is calculated simply in the classic way of taking the sum of all duration values in the events in a timespan and dividing that sum by the number of events in the timespan.

[NK_1]

I looked closer at my raw logs, and noticed transactions that appear to span multiple hours that got included as I increased the span=, that was causing this behavior. Thanks!