Average of the total count

[krusovice]

Hello all,

How can I get the average of the output as below?

Calculation is 40 + 20 + 50 / 3 = 36.6

REQUEST          ID          DURATION          AVERAGE
AAA              1122        40 seconds        36.6 seconds
BBB              3344        20 seconds
CCC              5566        50 seconds

Thanks.

[deepashri_123]

Hey krusovoice,

You can try this run anywhere query:

| makeresults | eval Request="AAA BBB CCC" | makemv Request| mvexpand Request | appendcols [| makeresults | eval ID="1122 3344 5566" | makemv ID| mvexpand ID ] |  appendcols [| makeresults | eval Duration="40seconds 50seconds 20seconds" | makemv Duration| mvexpand Duration ] |rex field=Duration "(?P<Dur>\d+)"| eventstats avg(Dur) AS avgDur

OR you can add this to your query:
|rex field=Duration "(?P\d+)"| eventstats avg(Dur) AS avgDur

Let me know if this helps!!

[krusovice]

Hi deepashri_123,

eventstats just make the trick! Thank you as always.

[deepashri_123]

@krusovice,
Please Upvote the answer if that helped!!
Thanks!!

[493669 · Accepted solution]

Hi @krusovice,
try this:

...|rex field="DURATION" "(?<DURATION>\d+)"
|eventstats avg(DURATION) as average
|eval average=round(average,1)." seconds"

Try this run anywhere search:

|makeresults|eval REQUEST="AAA", DURATION="40 seconds"
|append[|makeresults|eval REQUEST="BBB", DURATION="20 seconds"]
|append[|makeresults|eval REQUEST="CCC", DURATION="50 seconds"]
|rex field="DURATION" "(?<DURATION>\d+)"
|eventstats avg(DURATION) as average
|eval average=round(average,1)." seconds"

[krusovice]

Thank you @493669 for the great helps! It's work well in my dashboard.