| makeresults | eval _raw="ldate firstaction 2019-12-29 06:00:00.000 2019-12-30 09:00:00.000 2019-12-31 07:00:00.000" | multikv forceheader=1 | table ldate firstaction | rename COMMENT as "this is sample you provided" | rename COMMENT as "from here, the logic" | eval temp=substr(firstaction,1,8) | convert dur2sec(temp) | stats mean(temp) as firstaction_avg | eval firstaction_avg = tostring(firstaction_avg,"duration") Since the search result is a character string once, it needs to be changed to time . This is the query to convert from your search results. ... View more