I am using Splunk to chart the average duration of a transaction, for each host, refer to the search query below
(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H")
AND source = "logs/BAU.log"
| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
| chart avg(duration) by host
I now have a chart with avg(duration) in seconds as the Y-axis, host as the X-axis.
How do I change avg(duration)
so that it's expressed in decimal minutes (something like 2.34 mins) instead of the current seconds.
Thanks
You can modify the avg(duration)
to minutes in your Splunk query using eval
.
Here's the code :
(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") AND source = "logs/BAU.log"
| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
| eval duration=duration/60
| chart avg(duration) by host
Hope my answer will help.