@neerajs_81 When it's formatted as strings like "1 hour, 29 minutes", you'll need to convert those time strings into a numeric format first(typically total minutes) before applying stats avg() Eg:...
See more...
@neerajs_81 When it's formatted as strings like "1 hour, 29 minutes", you'll need to convert those time strings into a numeric format first(typically total minutes) before applying stats avg() Eg: | your_base_search
| eval time_parts=split(avg_time, ", ")
| eval hours=tonumber(replace(mvindex(time_parts, 0), " hour[s]?", ""))
| eval minutes=tonumber(replace(mvindex(time_parts, 1), " minute[s]?", ""))
| eval total_minutes=(hours * 60) + minutes
| stats avg(total_minutes) as average_min Regards, Prewin Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!