Subtraction of the duration

[splunkpoornima]

Hi

i hav the current duration of each and ever task as

time Taskname duration to complete the task

11.30 task1 1

11.32 task2 0.56

11.40 task1 1.35

11.21 task3 4

now i want to calculate the average duration of the each task ,and i have to calculate the difference between current duration and the avg duration of the corresponding task

[kristian_kolb]

Assuming you have the duration in a field called 'dur'

your_search | eventstats avg(dur) AS avgdur | eval durdiff = dur - avgdur | table avg_dur durdiff

You may also want to round off the numbers by inserting an eval avgdur=round(avgdur,x) after the eventstats. x is the number of decimal figures you want.

Hope this helps,

Kristian