How do you find the average delta of sum of fields in multiple events?

[tommasocurto]

I need to be able to find the average of the daily delta of the sum of all BCP* fields and I am trying to do something like this:

...search...    
    | transaction _time
    | addtotals BCP* fieldname=bcp
    | delta bcp as delta_bcp
    | stats avg(delta_bcp)

But it doesn't work. How can I accomplish this?

[pjdwyer]

To sum all of the BCP values you would need to use a case eval to make sure you capture all BCP values in a single event. Her is how I would do that:

| eval sumbcp=case(isnull(BCP3),BCP0+BCP1+BCP2,1=1,BCP0+BCP1+BCP2+BCP3)

The value in sumbcp would be the sum of all the BCP in the event. If BCP3 does not exist (it is null) it wont try adding it to the total, otherwise it will add BCP3.

The 1=1 is used as an else statement.

[renjith_nair · Accepted solution]

Hi @tommasocurto,

Try

your search |addtotals BCP* fieldname=bcp|timechart span=1d sum(bcp) as bcp|delta bcp as delta_bcp|fillnull value=0 delta_bcp|stats avg(delta_bcp)

you shall replace fillnull with your choice to adjust the average for the first value

[tommasocurto]

Thank you, this works just fine without "|fillnull value=0 delta_bcp".