Aggregate stats functions

[Marco]

Hi folks,

host=* AlertType="Warning" |bucket _time span=day| stats count min(count) max(count)  avg(count) stdev(count) by _time

This is what the results look like:

_time count min(count) max(count) avg(count) stdev(count)

_time	count	min	max	avg	stdev
2020-08-05	71
2020-08-06	109
2020-08-07	282
2020-08-08	44
2020-08-09	45
2020-08-10	36

I get the other columns blank, I want the query to return the Min, Max, Avg, and STD from the data in the Count column

Thank you,

Marco

[ITWhisperer · Accepted solution]

count doesn't have a value until the first stats completes

host=* AlertType="Warning" |bucket _time span=day
| stats count by _time
| stats min(count) max(count) avg(count) stdev(count)