How to only display columns where the duration is > 1 second?

[djoobbani]

Dear Splunk Community :

I have the following search query:

<Basic_search> duration | stats count, avg(duration), perc99(duration), by path_template

Attached please find a sample of the screen result for the above search.

[bowesmana · Accepted solution]

Maybe you're looking for

| eval "avg(duration)"=if('avg(duration)'<1,null(),'avg(duration)')
| eval "perc99(duration)"=if('perc99(duration)'<1,null(),'perc99(duration)')

which will clear any values that are less than zero in the two duration columns.

Note you would be better off renaming your columns in the stats, as it makes it easier to manipulate the fields afterwards, e.g.

| stats count, avg(duration) as AvgDuration, perc99(duration) asP99Duration, by path_template

[djoobbani]

Great, that works! Thanks for the info. appreciate it!

[djoobbani]

Sorry forgot to ask the question.

I need to modify this search :

source=r42-core-api msg="served request" duration | stats count, avg(duration)  by path_template

to only display the columns/numbers where avg(duration) > 1 second.

How do i do that?

Thanks!

[ITWhisperer]

duration isn't one of your columns