Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to compute _indextime-_time difference average with tstats?

$
0
0
Hi, I'd like to calculate the average latency (_indextime-_time) with the tstats command, but I can not make it work: | tstats avg(_indextime-_time) where (index=* OR index=_*) by index Splunk thinks "_indextime-_time" is a field name. How can I compute the difference in the tstats? Thank you

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>