How do we find the average of a table column filled with time values?
sample:
index=_internal sourcetype=splunkd* | timechart span=1h count by sourcetype | untable _time sourcetype count | eventstats avg(count) as average by sourcetype
try untable and eventstats after timechart