What is the default duration time unit for splunk? is it seconds?
Yes, the duration is measured in seconds. I don't believe there is a parameter to change the default but you could certainly convert the duration from seconds into something else using the eval command.
Yes, the duration is measured in seconds. I don't believe there is a parameter to change the default but you could certainly convert the duration from seconds into something else using the eval command.
@sdaniels kewl thanks, than obviously my transaction query is wrong. thanks again. good intel
How do I explain a transaction duration of 91 when the event time stamps range over only 3 seconds?