sourcetype="emailprocess" | eval processingtimeinseconds = processingtime/1000 | table email, processingtime ,processingtimeseconds | chart sum(processingtimeseconds), count(processing_time) by email
The output of this is
I would like to add another column called averagetime that lists averagetime for each email. Note averagetime=sum(processingtimeseconds) / count(processingtime)
As per your example, all you need to do is add
| eval Avg=Total/Count to your existing query. PS: I have renamed fields for easy use in Splunk query and also for readability. If you need column names same as what you have specified you can
1) Either use single quotes to escape special characters in the field name (for the field names in your query)
2) or else use rename command to rename fields to what you need.
sourcetype="email_process" | eval processing_time_in_seconds = processing_time/1000 | table email, processing_time ,processing_time_seconds | chart sum(processing_time_seconds) as Total, count(processing_time) as Count by email | eval Avg=Total/Count