- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to add a column of averages to a timechart?
JLIVE101
Engager
07-28-2016
02:22 PM
Similar to how timechart sum() by ip | addtotals
which adds a "Totals" Column to a timechart, how can you add an averages column?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

somesoni2
Revered Legend
07-28-2016
02:35 PM
I don't think there is a native way to get that. Try this workaround
... timechart sum(..) by ip | eval count=0 | foreach * [eval count=count+1] | addtotals | eval Average=Totals/count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

jhayIV
Engager
01-05-2017
10:10 AM
This worked perfect for me
