如何将Splunk图表中avg(duration)从秒转换为小数分钟？

你只需要将秒数除以60转换为分钟，有两种简单的实现方式：

方式1：先通过eval生成分钟字段再统计 #

先将duration字段转换为分钟单位的新字段，再用chart统计该字段的平均值：

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") 
AND source = "logs/BAU.log"

| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
| eval duration_min = duration / 60  // 将秒转换为小数分钟
| chart avg(duration_min) as avg_duration_min by host

方式2：直接在chart命令中计算 #

不需要额外生成字段，直接在avg()函数里完成单位转换：

(host = "A" OR host = "B" OR host = "C" OR host = "D" OR host = "E" OR host = "F" OR host = "G" OR host = "H") 
AND source = "logs/BAU.log"

| transaction submission_id startswith="ABC Logic begins" endswith="ABC Logic ended"
| chart avg(duration/60) as avg_duration_min by host

如果需要控制小数位数，还可以嵌套round()函数，比如round(duration/60, 2)来强制保留两位小数，让结果更规整。

内容的提问来源于stack exchange，提问作者waffledood