Function AVG() give the wrong result ?

[luthfi49]

Hi all,

When I use query : mysearch | stats avg(X)

It is supposed that the result is the average value of field X in the time range choosed.

But it is not give the proper result, I check it with top command and the value of the avg() is higher than the value in top command.

If the time range is longer, the result is more unproper

Is My Search's Query wrong ?

Here is my example search (time range 5 minutes) :

my search | stats avg(fieldX)

the result : 1273.0959

validation search (time range 5 minutes) search just before my above search

my search | top fieldX

the result's maximum value : 1137

[zeroactive]

Insted of using "top fieldX", for the reasons stated by Ayn, use the following to see the maximum value in fieldX:

mysearch | stats max(fieldX)

[Ayn · Accepted solution]

top fieldX just tells you the number of events that have a certain value for fieldX. It doesn't use the value of the field in any other way.

So in your case, say you have the following values for fieldX:

1137
1250
1500
1137
1335
1137

top will then give you 1137 first of all, because that's the most commonly occurring value in your set. However the average of all the values in the set will be higher, because (1137+1250+1500+1137+1335+1137)/6 = 1249.3333.

[luthfi49]

I'm sorry I didn't check the top command first.
Too early to ask the forum for my simple question 😄

Thanks 🙂