Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Doing math on results of sum(duration) of transaction?

$
0
0
I have a search that results in showing the time a phone was in a call in seconds by using sum(duration) of the events: | transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call(seconds) by codec | sort sum(duration) | reverse I'd like to get that the Time_in_call(seconds) to be in minutes. I thought it might be as simple as : | transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as **Time_in_call(seconds) / 60** by codec | sort sum(duration) | reverse or something like | transaction Tag |**eval Time_in_call(minutes) as sum(duration) / 60** | chart count(Tag) as NumberOfCalls **Time_in_call(minutes)** by codec | sort sum(duration) | reverse It looks like eval doesn't allow sum() anything . This seems straightforward but I'm at a loss even after spending 30 minutes searching around here.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>