For some reason the Parenthesis on avg(Duration) won't work.
I have entered the answer "index=main sourcetype=db_audit | stats avg(Duration)" but when I enter it, I get an additional set of parenthesis
I don't know if this is the paren problem, but Splunk is sensitive to spaces.
For example
index=_internal avg_age=* | stats avg(avg_age)
If I put a space after avg I get an error
index=_internal avg_age=* | stats avg (avg_age)
Error in 'stats' command: The argument '(avg_age)' is invalid.