I need to be able to find the average of the daily delta of the sum of all BCP* fields and I am trying to do something like this:
| transaction _time
| addtotals BCP* fieldname=bcp
| delta bcp as delta_bcp
| stats avg(delta_bcp)
But it doesn't work. How can I accomplish this?
your search |addtotals BCP* fieldname=bcp|timechart span=1d sum(bcp) as bcp|delta bcp as delta_bcp|fillnull value=0 delta_bcp|stats avg(delta_bcp)
you shall replace fillnull with your choice to adjust the average for the first value
View solution in original post
To sum all of the BCP values you would need to use a case eval to make sure you capture all BCP values in a single event. Her is how I would do that:
| eval sumbcp=case(isnull(BCP3),BCP0+BCP1+BCP2,1=1,BCP0+BCP1+BCP2+BCP3)
The value in sumbcp would be the sum of all the BCP in the event. If BCP3 does not exist (it is null) it wont try adding it to the total, otherwise it will add BCP3.
The 1=1 is used as an else statement.
Thank you, this works just fine without "|fillnull value=0 delta_bcp".