Getting averages from 2 columns

[dbcase]

Hi,

I have a query that looks like this

index=wholesale_app counter buildTarget=* product=* Properties.index=0 buildTarget=* product=*|convert num(Properties.args{}) as loginms|eval dura=loginms/1000|eval duration=ceil(dura)|where duration<=60|stats count as statscount by duration|sort duration|rename duration as "Login Duration in Seconds" statscount as "Number of times the Login Duration Occurred"| appendpipe [stats count | where count=0]

It makes a table that shows this

What I'd like to to is get an average number of seconds for login duration but using both columns. Example

1 second occurred 16 times so 1 second would have to be counted 16 times in the average.

Thoughts?

[somesoni2 · Accepted solution]

Give this a try

 index=wholesale_app counter buildTarget=* product=* Properties.index=0 buildTarget=* product=*|convert num(Properties.args{}) as loginms|eval dura=loginms/1000|eval duration=ceil(dura)|where duration<=60|stats count as statscount by duration|sort duration| appendpipe [stats count | where count=0]
| eval noofsecs=statscount*duration | stats sum(noofsecs) as noofsecs sum(statscount) as totaloccurances | eval "Average number of secs per login"=round(noofsecs/totaloccurances,2)

[dbcase]

Hey Somesoni2!

Very nice solution! Thank you! (Again)