Display Avg Column

[signpriya82]

sourcetype="email_process" | eval processing_time_in_seconds = processing_time/1000 | table email, processing_time ,processing_time_seconds | chart sum(processing_time_seconds), count(processing_time) by email

The output of this is

email sum(processing_time_seconds) count(processing_time)
a@xx.com 1000 2
b@xx.com 2000 10

I would like to add another column called average_time that lists average_time for each email. Note average_time=sum(processing_time_seconds) / count(processing_time)

Desired output
email sum(processing_time_seconds) count(processing_time) Avg_Time_millisecond
a@xx.com 1000 2 500
b@xx.com 2000 10 200

[niketn]

As per your example, all you need to do is add | eval Avg=Total/Count to your existing query. PS: I have renamed fields for easy use in Splunk query and also for readability. If you need column names same as what you have specified you can
1) Either use single quotes to escape special characters in the field name (for the field names in your query)
2) or else use rename command to rename fields to what you need.

 sourcetype="email_process" 
| eval processing_time_in_seconds = processing_time/1000 
| table email, processing_time ,processing_time_seconds 
| chart sum(processing_time_seconds) as Total, count(processing_time) as Count by email
| eval Avg=Total/Count

[niketn]

@signpriya82... Did this answer or something else worked out for you?