How can I split my data to show the average based on column values?

[angersleek]

I am using the following query to split my data to show the average, min, and max based on the fields. But, I seem to be getting a total value instead of a proper split.

Expected outcome: (I am open to ideas if there is a better way of displaying this)

average      maximum         minimum            environment        app_name
10           100             2                  env 1              service 1
12           180             3                  env 1              service 2
13           110             22                 env 1              service 3
34           100             21                 env 1              service 4
66           290             0                  env 1              service 5

10           100             2                  env 2              service 1
12           180             3                  env 2              service 2
13           110             22                 env 2              service 3
34           100             21                 env 2              service 4
66           290             0                  env 2              service 5

Actual outcome

average     maximum         minimum             environment        app_name
134         100             12                  env 1              service 1
                                                env 2              service 2
                                                                   service 3 
                                                                   service 4
                                                                   service 5

Search used:

some_search=* environment=* some_time=* | chart avg(some_time) as average, max(some_time) as maximum, min(some_time) as minimum, values(environment) as environment, values(app_name)

[whrg · Accepted solution]

Hi! Use the stats command along with the by clause when charting over multiple fields.

Try it like this:

| stats avg(some_time) as average max(some_time) as maximum min(some_time) as minimum by environment,app_name

[angersleek]

Perfect. Thanks.