Splunk Search
Highlighted

timechart with math function

Motivator

i am using timechart like this

search | timechart span=10m avg(diff)

but the diff number is in seconds I would like the answer in minutes like this

search | timechart span=10m avg(diff)/60

this doesn't work

Anyone have a suggestion??

Tags (2)
0 Karma
Highlighted

Re: timechart with math function

Communicator

Before creating your timechart, use an eval function to format your variable the way you would like. So try something like:

search | eval diffinmin=(diff/60) | timechart span=10m avg(diffinmin)

View solution in original post

Highlighted

Re: timechart with math function

Motivator

thanks much

0 Karma
Highlighted

Re: timechart with math function

New Member

A simpler way may be to use eval() (as function):
search | timechart span=10m eval(avg(diff)/60) as diff_in_min

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.