Thanks for the prompt reply.
I just thought that running the eval to convert ms to seconds 13 million times as opposed to once prior to the chart command would have a cumulative effect on the overall performance. Moving the bin command to just before chart did seem to help some.
From the job inspector, it looks like most of the time is spent in dispatch.stream.remote. Since I have no idea what that is, I'll capture the job inspector output and the search log and send them to our Splunk admin.
... View more