I have this query and I'm trying to convert the response time from milliseconds to seconds but it's not working. What did I miss?
sourcetype="imetrics" name=http*://* | regex name!="http*://.*\d+$" | stats count by name,data.avg_response_time_ms,data.avg_error_rate | eval "data.avg_response_time_ms(ms)"='data.avg_response_time_ms(ms)'/1000 |sort -data.avg_response_time_ms
Note = the milliseconds written like this on the logs "1660.9425"
Try renaming the response time field,
sourcetype="imetrics" name=http*://* | regex name!="http*://.*\d+$" | rename "data.avg_response_time_ms" as avg_response_time , "data.avg_error_rate" as avg_error_rate |stats count by name,avg_response_time ,avg_error_rate | eval avg_response_time_sec=avg_response_time/1000 |sort -avg_response_time_sec
View solution in original post