There is no difference if you use your base search here | eval myTime=ltrim(DURATION, "ms") | timechart span=1h avg(myTime) AS Duration or your base search here | eval DURATION=ltrim(DURATION, "ms") | timechart span=1h avg(DURATION) AS Duration The first uses a newly created field and the second always uses DURATION as field name. ... View more

This is what I expected. Thank you for the quick reply. But can u tell how I am getting the domain name without any group by. Is it because domain name is unique. ... View more