Hi @Jewatson17,
What you are trying is distinct_count which function will just return the distinct count of values of requestTime. If you just want count then it doesn't matter weather that is in milliseconds or in seconds. I think you should try other functions like avg or sum . In that case you can convert milliseconds into seconds, try below query (where I've used avg function but you can use anything else).
host=<hostname> index=<index name> sourcetype="sourcetype name>" SP="8*" | rex field=_raw "TM=(?<requestTime>\d+)" | timechart span=1h eval(avg(requestTime)/1000) by SP useother=false | eval warning = 10000
Hopefully this helps, correct me if I understand your requirement incorrectly.
... View more