Below is the search from the *nix app for interface throughput, but I have a question regarding the eval command for the timechart. Does the “dc(time)” indicate that we are dividing by the timeframe in seconds? Example: For a 60 min timeframe are we dividing by 3600 seconds? How do I calculate duration, when _time is the only value available? timechart eval(sum(TX_Thruput_KB)/dc(time)) index="os" sourcetype="interfaces" host=* | multikv fields name, inetAddr, RXbytes, TXbytes | streamstats current=f last(TXbytes) as lastTX, last(RXbytes) as lastRX by Name | eval time=_time | strcat Name "-" inetAddr "@" host Interface_Host | eval RX_Thruput_KB = (lastRX-RXbytes)/1024 | eval TX_Thruput_KB = (lastTX-TXbytes)/1024 | timechart eval(sum(TX_Thruput_KB)/dc(time)) by Interface_Host ... View more