Dear Splunk Community :
I have the following search query:
<Basic_search> duration | stats count, avg(duration), perc99(duration), by path_template
Attached please find a sample of the screen result for the above search.
Maybe you're looking for
| eval "avg(duration)"=if('avg(duration)'<1,null(),'avg(duration)')
| eval "perc99(duration)"=if('perc99(duration)'<1,null(),'perc99(duration)')
which will clear any values that are less than zero in the two duration columns.
Note you would be better off renaming your columns in the stats, as it makes it easier to manipulate the fields afterwards, e.g.
| stats count, avg(duration) as AvgDuration, perc99(duration) asP99Duration, by path_template
Maybe you're looking for
| eval "avg(duration)"=if('avg(duration)'<1,null(),'avg(duration)')
| eval "perc99(duration)"=if('perc99(duration)'<1,null(),'perc99(duration)')
which will clear any values that are less than zero in the two duration columns.
Note you would be better off renaming your columns in the stats, as it makes it easier to manipulate the fields afterwards, e.g.
| stats count, avg(duration) as AvgDuration, perc99(duration) asP99Duration, by path_template
Great, that works! Thanks for the info. appreciate it!
Sorry forgot to ask the question.
I need to modify this search :
source=r42-core-api msg="served request" duration | stats count, avg(duration) by path_template
to only display the columns/numbers where avg(duration) > 1 second.
How do i do that?
Thanks!
duration isn't one of your columns