Doing math on results of sum(duration) of transaction?

[splunk_newb]

I have a search that results in showing the time a phone was in a call in seconds by using sum(duration) of the events:

| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call(seconds) by codec | sort sum(duration) | reverse

I'd like to get that the Time_in_call(seconds) to be in minutes. I thought it might be as simple as :

| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call(seconds) / 60 by codec | sort sum(duration) | reverse

or something like | transaction Tag |eval Time_in_call(minutes) as sum(duration) / 60 | chart count(Tag) as NumberOfCalls Time_in_call(minutes) by codec | sort sum(duration) | reverse

It looks like eval doesn't allow sum() anything . This seems straightforward but I'm at a loss even after spending 30 minutes searching around here.

[cmerriman · Accepted solution]

Alright, a few things about your syntax. in your chart, you're renaming sum(duration) as Time_in_call(seconds), and then trying to sort by sum(duration), which won't work, but then reversing the order of events, so try this to help be more efficient.

| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call_seconds by codec |eval Time_in_call_minutes=round(Time_in_call_seconds/60,2)| sort 0 - Time_in_call_minutes 

this should eval the duration into minutes and sort the duration descending.

[splunk_newb]

Works like a champ. I didn't know that my results fields could be outside of the chart area. It's also interesting on how it summarizes this data without having to use sum() on it.

Thanks!