Subtraction of the time duration

[splunkpoornima]

I used the below query and i got the following result

source="ADFER"|transaction Taskaction startswith="START" endswith="Succeeded"|stats avg(duration) by Taskaction

i got the result as,

Taskaction avg(duration)

a 1.45

b 23.67

so i want to subtract my avg(duration) with 16.857934 for each task.i want the result lik below

Taskaction duration

a -15.40

b 6.812066

[MHibbin]

Hi,

You will need to pipe to an eval command, where you can do some mathematics using the Splunk langauge and assign the values to a field for example..

source="ADFER"|transaction Taskaction startswith="START" endswith="Succeeded"|stats avg(duration) as avgduration by Taskaction | eval duration=avgduration-16.857934

Or you could use eval to assign the '16.857934' to a field and do the following:

source="ADFER"|transaction Taskaction startswith="START" endswith="Succeeded"|stats avg(duration) as avgduration by Taskaction | eval minVal="16.857934" |eval duration=avgduration-minVal

You should read the docs on this:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/eval
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

[Ayn · Accepted solution]

source="ADFER"|transaction Taskaction startswith="START" endswith="Succeeded"|stats avg(duration) as duration by Taskaction | eval duration=duration-16.857934

[splunkpoornima]

thank u very much
it is Working fine ..