Splunk Search

How do I convert milliseconds to seconds on stats output?

raindrop18
Communicator

I have this query and I'm trying to convert the response time from milliseconds to seconds but it's not working. What did I miss?

sourcetype="imetrics" name=http*://*  | regex name!="http*://.*\d+$" |  stats count by name,data.avg_response_time_ms,data.avg_error_rate  | eval "data.avg_response_time_ms(ms)"='data.avg_response_time_ms(ms)'/1000 |sort -data.avg_response_time_ms

Note = the milliseconds written like this on the logs "1660.9425"

thanks.

Tags (1)
0 Karma
1 Solution

Vijeta
Influencer

Try renaming the response time field,

sourcetype="imetrics" name=http*://*  | regex name!="http*://.*\d+$" |  rename "data.avg_response_time_ms" as avg_response_time , "data.avg_error_rate" as avg_error_rate |stats count by name,avg_response_time ,avg_error_rate  | eval avg_response_time_sec=avg_response_time/1000 |sort -avg_response_time_sec

View solution in original post

Vijeta
Influencer

Try renaming the response time field,

sourcetype="imetrics" name=http*://*  | regex name!="http*://.*\d+$" |  rename "data.avg_response_time_ms" as avg_response_time , "data.avg_error_rate" as avg_error_rate |stats count by name,avg_response_time ,avg_error_rate  | eval avg_response_time_sec=avg_response_time/1000 |sort -avg_response_time_sec
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...