I have a search that results in showing the time a phone was in a call in seconds by using sum(duration) of the events:
| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call(seconds) by codec | sort sum(duration) | reverse
I'd like to get that the Time_in_call(seconds) to be in minutes. I thought it might be as simple as :
| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call(seconds) / 60 by codec | sort sum(duration) | reverse
or something like | transaction Tag |eval Time_in_call(minutes) as sum(duration) / 60 | chart count(Tag) as NumberOfCalls Time_in_call(minutes) by codec | sort sum(duration) | reverse
It looks like eval doesn't allow sum() anything . This seems straightforward but I'm at a loss even after spending 30 minutes searching around here.
Alright, a few things about your syntax. in your chart, you're renaming sum(duration) as Time_in_call(seconds), and then trying to sort by sum(duration), which won't work, but then reversing the order of events, so try this to help be more efficient.
| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call_seconds by codec |eval Time_in_call_minutes=round(Time_in_call_seconds/60,2)| sort 0 - Time_in_call_minutes
this should eval the duration into minutes and sort the duration descending.
Alright, a few things about your syntax. in your chart, you're renaming sum(duration) as Time_in_call(seconds), and then trying to sort by sum(duration), which won't work, but then reversing the order of events, so try this to help be more efficient.
| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call_seconds by codec |eval Time_in_call_minutes=round(Time_in_call_seconds/60,2)| sort 0 - Time_in_call_minutes
this should eval the duration into minutes and sort the duration descending.
Works like a champ. I didn't know that my results fields could be outside of the chart area. It's also interesting on how it summarizes this data without having to use sum() on it.
Thanks!