splunksplunk-query

Splunk - Charting average transaction duration (Y-axis) over host (X-axis)


I am using Splunk to chart the average duration of a transaction, for each host, refer to the search query below

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") 
AND source = "logs/BAU.log"

| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"

| chart avg(duration) by host

I now have a chart with avg(duration) in seconds as the Y-axis, host as the X-axis.

my splunk chart

How do I change avg(duration) so that it's expressed in decimal minutes (something like 2.34 mins) instead of the current seconds.

Thanks


Solution

  • You can modify the avg(duration) to minutes in your Splunk query using eval.

    Here's the code :

    (host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") AND source = "logs/BAU.log"
    | transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
    | eval duration=duration/60 
    | chart avg(duration) by host
    

    Hope my answer will help.