Splunk Search

How do I convert milliseconds to seconds on stats output?

raindrop18
Communicator

I have this query and I'm trying to convert the response time from milliseconds to seconds but it's not working. What did I miss?

sourcetype="imetrics" name=http*://*  | regex name!="http*://.*\d+$" |  stats count by name,data.avg_response_time_ms,data.avg_error_rate  | eval "data.avg_response_time_ms(ms)"='data.avg_response_time_ms(ms)'/1000 |sort -data.avg_response_time_ms

Note = the milliseconds written like this on the logs "1660.9425"

thanks.

Tags (1)
0 Karma
1 Solution

Vijeta
Influencer

Try renaming the response time field,

sourcetype="imetrics" name=http*://*  | regex name!="http*://.*\d+$" |  rename "data.avg_response_time_ms" as avg_response_time , "data.avg_error_rate" as avg_error_rate |stats count by name,avg_response_time ,avg_error_rate  | eval avg_response_time_sec=avg_response_time/1000 |sort -avg_response_time_sec

View solution in original post

Vijeta
Influencer

Try renaming the response time field,

sourcetype="imetrics" name=http*://*  | regex name!="http*://.*\d+$" |  rename "data.avg_response_time_ms" as avg_response_time , "data.avg_error_rate" as avg_error_rate |stats count by name,avg_response_time ,avg_error_rate  | eval avg_response_time_sec=avg_response_time/1000 |sort -avg_response_time_sec
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...