Splunk - Charting average transaction duration (Y-axis) over host (X-axis)

Question

I am using Splunk to chart the average duration of a transaction, for each host, refer to the search query below

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") 
AND source = "logs/BAU.log"

| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"

| chart avg(duration) by host

I now have a chart with avg(duration) in seconds as the Y-axis, host as the X-axis.

How do I change avg(duration) so that it's expressed in decimal minutes (something like 2.34 mins) instead of the current seconds.

Thanks

Answer 1

You can modify the avg(duration) to minutes in your Splunk query using eval.

Here's the code :

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") AND source = "logs/BAU.log"
| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
| eval duration=duration/60 
| chart avg(duration) by host

Hope my answer will help.