How to calculate the average from the result of the range function?

[carlpier]

Hello,
I am looking for a way to calculate the avg from the result of the range function.
Here is the simple base search which finds all values for exit_status:

index="nbdrest-performance" sourcetype="PerfNBDCustomTSV"| chart count min(ETms) max(ETms) avg(ETms) stdev(ETms) median(ETms) mode(ETms) range(ETms) perc99(ETms) by Service | sort count | reverse

I have to calculate the avg from the result of “range(ETms)”

Any help would be greatly appreciated.

Thanks in advance

[aweitzman]

Easiest way to do this is use eventstats to add it to your table:

...your search... | eventstats avg(range(ETms))

[carlpier]

I want to see the average of a single service, your solution is exposed in the grand total ( 5120.341137) for each service

[aweitzman]

You already have the "average of a single service" in your initial post: ....avg(ETms)... by Service

What do you believe you are missing?

[aweitzman]

Please show a table of what your results are now, and another table of what you want them to be. Please include column headers.

[carlpier]

thanks for the replay, the function EventStats shows the total of each line, but I have to expose it to a single service

index="nbdrest-performance" sourcetype="PerfNBDCustomTSV"| chart count min(ETms) max(ETms) range(ETms) by Service | eventstats avg(range(ETms)) | sort count | reverse

Service1 122286 1 1113 1112 5120.341137
Service2 63534 4 11109 11105 5120.341137

[aweitzman]

eventstats is computing the average of every entry in range(ETms), and adding that result in a new column to each entry. If that isn't what you want, can you please show what you want your result to look like?

Also, when you do, please use the "code sample" button in the editor so that it looks like this, it will make it much easier to read:

Service1 122286 1  1113  1112 5120.341137
Service2  63534 4 11109 11105 5120.341137