Get average from multiple field in XML

[yurykiselev]

Hi!
I have XML-events with different name values:

<reactiontimes>
<rt1>1.42</rt1>
<rt2>1.31</rt2>
<rt3>1.33</rt3>
...
<rtN>X.XX</rtN>
</ractiontimes>

How can I get AVG of rt* for each event?
Thank you!

[woodcock]

Try this:

Your Base Search Here | streamstats count AS serial | fields serial rt* | untable serial rt_stuff count | stats avg(count) BY serial

That gives the avg of the values inside of each event. From there you can easily get further averages across events.

[dineshraj9 · Accepted solution]

Try this way -

index="dynavision" | streamstats count as event_count by _raw | rex max_match=0 "rt\d\>(?<REACTION_TIME>[\d\.]+)" | table _raw event_count REACTION_TIME | mvexpand REACTION_TIME | stats avg(REACTION_TIME) as AVG_REACTION_TIME by _raw event_count | fields - event_count | eval AVG_REACTION_TIME=round(AVG_REACTION_TIME,2)

[yurykiselev]

Thank you!

[yurykiselev]

Found something:

index="dynavision" | eval rt_sum = 0 | eval rt_count = 0 | foreach modeBdata.red.reactiontimes.rt* [eval rt_count = rt_count + 1 | eval rt_sum = rt_sum + '<<FIELD>>' ] | eval rt_avg = rt_sum / rt_count

But it seems works only for first event((