About mattheuslima

mattheuslima · ‎07-27-2020

It work!! Thank you !!!!

gcusello · ‎06-02-2020

Hi @mattheuslima, let me understand: you want to timechart the average duration in a timeframe of 15 minutes with span=1m, in the transaction, you want to thake the earliest time, is it correct? If this is your need try something like this (that's faster!): (index=a) OR (index=b) earliest=-15m@m latest=now | bin span=1m _time | stats earliest(_time) AS _time avg(duration) AS duration count BY Reg_ID | timechart avg(duration) AS media Ciao. Giuseppe

woodcock · ‎03-23-2020

Skip the subsearch and do this: index="A" OR index="B" | stats dc(index) AS indexCount values(index) AS index BY ID | where index="B" AND indexCount=1

Posts	5
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎03-23-2020

Online Status	Offline
Date Last Visited	‎08-25-2020 08:53 PM

How to convert a number into a Date?

Problems with average duration

Subsearch: How can we only see results when they a...

Re: How to convert a number into a Date

Re: Problems with average duration

Re: Subsearch: How can we only see results when th...

Are you a member of the Splunk Community?