I have data similiar to this:
Account Count TotalSessions
abc 4 12
xyz 2 12
zzz 6 12
..search | stats count by Account | eventstats sum(count) as TotalSessions
How do I get the calculation for TotalSessions/ # of Accounts? i.e. 12 divided by 3 in this example.
Like this
..search | stats count by Account | eventstats sum(count) as TotalSessions dc(Account) as TotalAccounts
| eval AvgSessionPerAccount=TotalSessions/TotalAccounts
Thanks for the quick solution. I'm now getting multiple instances for the calculation of AvgSessionPerAccount. How do I only show one result since all are the same?
Like this
..search | stats count by Account | eventstats sum(count) as TotalSessions dc(Account) as TotalAccounts
| eval AvgSessionPerAccount=TotalSessions/TotalAccounts
Thanks for the quick solution. I'm now getting multiple instances for the calculation of AvgSessionPerAccount. How do I only show one result since all are the same?