How to calculate the average of a column, and display this average next to it in a separate column?

[pavanae]

I displayed the list of people and their count by using the below search:

foo | stats dc(A) as people by B

which displayed as follows

people      B 
asd         23
sdas        32

Now how can I calculate the average of all the values in B and display the average in another column?

[cmerriman · Accepted solution]

foo | stats dc(A) as people by B|eventstats avg(people) as avgPeople|stats max(people) as people max(avgPeople) as avgPeople by B

something like this might be what you're looking for

[pavanae]

now how can I display only the people with B values greater than avgPeople and also how to calculate their count?

[cmerriman]

foo | stats dc(A) as people by B|eventstats avg(people) as avgPeople|stats max(people) as people max(avgPeople) as avgPeople by B|where people>avgPeople

calculate what count exactly? did you want to just add count to the first stats command and add max(count) as totalCount to the second command?

[pavanae]

I would be really appriciate if you can suggest me a way to display a timechart which displays the avgpeople and people by B with time. @cmerriman

[cmerriman]

foo | stats dc(A) as people by B _time|eventstats avg(people) as avgPeople|timechart span=1d max(people) as people max(avgPeople) as avgPeople by B |where people>avgPeople

you might play around with the first stats command. maybe add a |bucket _time span=1d before it or something, depending on what your _time field looks like.