I am using the following query to split my data to show the average, min, and max based on the fields. But, I seem to be getting a total value instead of a proper split.
Expected outcome: (I am open to ideas if there is a better way of displaying this)
average maximum minimum environment app_name
10 100 2 env 1 service 1
12 180 3 env 1 service 2
13 110 22 env 1 service 3
34 100 21 env 1 service 4
66 290 0 env 1 service 5
10 100 2 env 2 service 1
12 180 3 env 2 service 2
13 110 22 env 2 service 3
34 100 21 env 2 service 4
66 290 0 env 2 service 5
Actual outcome
average maximum minimum environment app_name
134 100 12 env 1 service 1
env 2 service 2
service 3
service 4
service 5
Search used:
some_search=* environment=* some_time=* | chart avg(some_time) as average, max(some_time) as maximum, min(some_time) as minimum, values(environment) as environment, values(app_name)
Hi! Use the stats command along with the by clause when charting over multiple fields.
Try it like this:
| stats avg(some_time) as average max(some_time) as maximum min(some_time) as minimum by environment,app_name
Hi! Use the stats command along with the by clause when charting over multiple fields.
Try it like this:
| stats avg(some_time) as average max(some_time) as maximum min(some_time) as minimum by environment,app_name
Perfect. Thanks.