How to divide the results of a timechart by statement?

[robertlynch2020]

Hi

I have a basic statement, however, I want the answers to be in per second. So I need to provide all the results by 60, however, as I am using the by command I cant do something like eval count = count/60. As all the columns are different - I might be able to use a for - but this might affect _time. Any ideas? Am i missing something simple hear?

index="murex_logs" 

| timechart span=1m count by mx.env

[somesoni2]

With dynamic columns, you'd use foreach command. Like this:

index="murex_logs" 
| timechart span=1m count by mx.env
| foreach * [| eval "<<FIELD>>"=round('<<FIELD>>'/60,2)]

"<<FIELD>>" is a literal string to be used as-is. See more information on foreach command here: https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Foreach

[Software-Simian]

index="murex_logs"
| bucket span=1min _time
| stats count by mx.enc _time