Use TimePicker to average on a specific field

[pwilly]

I have a dashboard with several inputs to include a timepicker, one of my panels charts the sums of specific fields over the time picked. I would like to add another column that acts upon one of those sums and get the avg per minute.

For example time picked is 4 hours
Column 1 = 480

The new column would then need to take that result and divide it by the number of minutes specified in the time picker
480/240minutes = 2 per minute

[DalJeanis]

It's going to look something like

| eval PerMinute = 60*MSG_1_COUNT / ($timerange.latest$ - $timerange.earliest$)

[somesoni2 · Accepted solution]

Try this. The eval on 2nd last line will add a field called Minutes, containing number of minutes in the selected timerange. You can use that for your 'per min' calculation.

index=Foo MGR_NAME=$Manager$ NAME=$Name$ AND $Params$ | eval TotalThroughput=(MSG_1_COUNT)+(MSG_2_COUNT)| chart sum(MSG_1_COUNT) AS In sum(MSG_2_COUNT) AS Out max(HIGH_MSG_DEPTH) as HighMSGDepth sum(TotalThroughput) AS TotalThroughput by NAME | eval NAME=substr(NAME,1,48) | sort - TotalThroughput 
| eval Minutes=[| gentimes start=-1 | addinfo | eval search=round((info_max_time-info_min_time)/60) | table search] 
| eval MSG_1_COUNT_PerMin=MSG_1_COUNT/Minutes | fields - Minutes

[DalJeanis]

cute. I hadn't thought of using addinfo instead of pulling it off the interface.

[rjthibod]

The community can best help you if you share part or whole of your search query. That way we can more efficiently help by targeting the specific fields and commands you are using.

[pwilly]

My search looks like the following
index=Foo MGR_NAME=$Manager$ NAME=$Name$ AND $Params$ | eval TotalThroughput=(MSG_1_COUNT)+(MSG_2_COUNT)| chart sum(MSG_1_COUNT) AS In sum(MSG_2_COUNT) AS Out max(HIGH_MSG_DEPTH) as HighMSGDepth sum(TotalThroughput) AS TotalThroughput by NAME | eval NAME=substr(NAME,1,48) | sort - TotalThroughput

I would like an additional column that per NAME looks at the sum of MSG_1_COUNT for that NAME and divides it by the number of minutes that will be specified in the timepicker input so I can get average MSG_1_COUNT per Minute
Thanks