help on subsearch with strange behaviour

[jip31]

hi

the search below returns results

index=tutu sourcetype=toto runq 
| search NOT runq=0.0 
| table runq host 
| join host 
    [ search index=tutu sourcetype=toto
    | fields type host cpu_core) 
    | stats max(cpu_core) as nbcore by host ] 
| eval Vel = (runq / nbcore) / 6

 but when I add 

table vel

or

| stats avg(Vel) as Vel

at the end of the search, there is no results

what is wrong please?

[ITWhisperer · Accepted solution]

It looks like you are just trying to find the maximum number of cpu_core for each host, so you could try eventstats:

index=tutu sourcetype=toto runq 
| search NOT runq=0.0 
| table runq host 
| eventstats max(cpu_core) as nbcore by host
| eval Vel = (runq / nbcore) / 6

[jip31]

I found, a sysntex error in eval...

[jip31]

you search is doing the same thing

and what I need is to be able to do an average on the field "Vel" ( | stats perc(Vel))

so as long as there is no results with | table Vel, I can't doing this average

How explain that I am not able to retrieve the field "Vel"?