I have a search that results in showing the time a phone was in a call in seconds by using sum(duration) of the events:
| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as Time_in_call(seconds) by codec | sort sum(duration) | reverse
I'd like to get that the Time_in_call(seconds) to be in minutes. I thought it might be as simple as :
| transaction Tag | chart count(Tag) as NumberOfCalls sum(duration) as **Time_in_call(seconds) / 60** by codec | sort sum(duration) | reverse
or something like | transaction Tag |**eval Time_in_call(minutes) as sum(duration) / 60** | chart count(Tag) as NumberOfCalls **Time_in_call(minutes)** by codec | sort sum(duration) | reverse
It looks like eval doesn't allow sum() anything . This seems straightforward but I'm at a loss even after spending 30 minutes searching around here.
↧