Losing duration in milliseconds when I add file size data...

[juriggs]

Hi,

I have to calculate duration in milliseconds which is working, but when I add file size data to the query, the duration goes to 0. Can anyone provide any guidance as to what's happening and how to resolve it?

Here's the query that works:

FILE="*" | stats range(timestamp) as durationms by FILE | eval duration=durationms/1000

but if I run this:

FILE="*" | stats range(timestamp) as durationms by FILE, FileSize | eval duration=durationms/1000

then duration and durationms go to 0.

Thanks in advance!

[yannK]

for the doc :
http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/CommonStatsFunctions

range(X) This function returns the difference between the max and min values of the field X ONLY IF the value of X are numeric. chart, stats, timechart, sparkline()

Maybe a rounding issue, or a missing value.

To verify that your values are actually not null, not identical, or not missing, please try :

FILE="*" | stats values(timestamp) min(timestamp) AS mintimestamp max(timestamp) AS maxtimestamp range(timestamp) as durationms by FILE, FileSize
| eval manualrange=maxtimestamp=mintimestamp
| eval duration=durationms/1000
| eval manualduration=manualrange/1000
| eval manualduration_round=round(manualrange/1000,10000000000)


[somesoni2]

In second search, if you run it without eval stuff, does the durationms shows zero?

[juriggs]

Yeah, I've done that. I have results UNTIL I add FileSize into the query. Does it have to do with the range function? The FileSize field is only in one of the events returned... if I change FILE to a specific file and add fields (like User) that are in both the events, everything works fine.

Thanks for your help...

[richgalloway]

Have you tried replacing the eval with 'table FILE durationms' to make sure you have results?