https://community.splunk.com/t5/Splunk-Search/Is-it-possible-within-the-same-search-to-find-the-count-of/m-p/237968#M70722 <P>thanks this worked. </P> Thu, 06 Oct 2016 19:56:49 GMT vamshi245 2016-10-06T19:56:49Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-within-the-same-search-to-find-the-count-of/m-p/237966#M70720 <P>I am trying to get the count of events where the transaction duration is above the average duration and below the average duration. </P> <P>below is my search to find out the count of events above the average transaction duration:</P> <PRE><CODE>index=whatever* sourcetype="Source" "COMPONENTNAME=X" AND "EVENT=Received"|eval receivedtime=SERVER_TIME |join type=inner ORDERNUMBER max=0[search index=tas_prod sourcetype="TAS:FUSION:ProdSupport:PRD:AuditDB" "COMPONENTNAME=Y" AND "EVENT=Delivered"|eval deliveredTime=SERVER_TIME ]|eval diff = deliveredTime-receivedtime| eventstats avg(diff) as Avg | where diff&gt;Avg| stats count as Grt </CODE></PRE> <P>is it possible to get the count of transactions with diff &lt; Avg in the same search? like: </P> <PRE><CODE>searchStatement|eval diff = deliveredTime-receivedtime| eventstats avg(diff) as Avg | where diff&gt;Avg| stats count as Grt | where diff &lt; Avg |stats count as Lsr </CODE></PRE> <P>please let me know if i can combine the count without using the same search statement another time to find the count for less than average</P> Thu, 06 Oct 2016 19:16:48 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-within-the-same-search-to-find-the-count-of/m-p/237966#M70720 vamshi245 2016-10-06T19:16:48Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-within-the-same-search-to-find-the-count-of/m-p/237967#M70721 <P>You could try this</P> <PRE><CODE>.... | stats count(eval(diff&gt;Avg)) as Grt count(eval(diff&lt;Avg)) as Lsr </CODE></PRE> Thu, 06 Oct 2016 19:50:11 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-within-the-same-search-to-find-the-count-of/m-p/237967#M70721 sundareshr 2016-10-06T19:50:11Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-within-the-same-search-to-find-the-count-of/m-p/237968#M70722 <P>thanks this worked. </P> Thu, 06 Oct 2016 19:56:49 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-within-the-same-search-to-find-the-count-of/m-p/237968#M70722 vamshi245 2016-10-06T19:56:49Z