How do convert a field and report on the average response time?

[Brian_Osburn]

I have a field in my Apache logs that's defined as "MicroSeconds". This is the response time in microseconds for a specific call in Apache to our Weblogic back ends.

I'm trying to generate a real time chart on the average response times based on the "Microseconds" field. I'd like to be able to convert microseconds to milliseconds so I don't freak out our users when they see a transaction hit 4000..

How would I do that? The basic search right now is:

index="uat_apache_logs" /pbng | timechart avg(MicroSeconds) 

which works good..I just need to convert it to milliseconds..

Thanks in advance.

[ebailey]

How did you define the field in Splunk? I assume you are using the Apache response time option in the log format?

Thanks

Ed

[gkanapathy · Accepted solution]

You can use the "eval" command to perform operations in field values: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval

In your case:

... | timechart avg(MicroSeconds) as avgus | eval avg_milliseconds = avgus/1000

[sideview]

Answer is disarmingly simple - just do the eval before the timechart instead of after. "eval milliseconds=MicroSeconds*1000 | timechart avg(milliseconds)"

[Brian_Osburn]

That works. Anyway to make drilldown work with this? I get a "# PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'eval' command"

Brian