https://community.splunk.com/t5/Splunk-Search/Multi-column-stats-average-and-count-for-a-column/m-p/17443#M2448 <P>The <CODE>stats</CODE> command allows many input columns and many aggregation functions on any or all of them. The above syntax is valid and correct for what you have stated.</P> Thu, 15 Jul 2010 10:43:54 GMT gkanapathy 2010-07-15T10:43:54Z https://community.splunk.com/t5/Splunk-Search/Multi-column-stats-average-and-count-for-a-column/m-p/17442#M2447 <P>I am building a search to find the average amount of time an action takes:</P> <BLOCKQUOTE> <P>sourcetype="timelog" | stats avg(request_duration) by requested_file</P> </BLOCKQUOTE> <P>However, I would also like to see the number of hits represented in that average which I would intuitively write like so:</P> <BLOCKQUOTE> <P>sourcetype="timelog" | stats avg(request_duration), count(request_duration) by requested_file</P> </BLOCKQUOTE> <P>Of course, this is invalid syntax because stats only allows one input column.</P> <P>What is the proper way to write this search?</P> Thu, 15 Jul 2010 08:18:58 GMT https://community.splunk.com/t5/Splunk-Search/Multi-column-stats-average-and-count-for-a-column/m-p/17442#M2447 isnoop 2010-07-15T08:18:58Z https://community.splunk.com/t5/Splunk-Search/Multi-column-stats-average-and-count-for-a-column/m-p/17443#M2448 <P>The <CODE>stats</CODE> command allows many input columns and many aggregation functions on any or all of them. The above syntax is valid and correct for what you have stated.</P> Thu, 15 Jul 2010 10:43:54 GMT https://community.splunk.com/t5/Splunk-Search/Multi-column-stats-average-and-count-for-a-column/m-p/17443#M2448 gkanapathy 2010-07-15T10:43:54Z