Hello guys! Sup?
Can anyone help me to get the average of all current search events and not only the first ones. I have this search below which has everything I need, but just missin' the correct average. How can I achieve the correct average and variation:
index=main sourcetype=main_pc BOTH=* TABLE_VALUE=* PROCESS_NAME=*
| eval PROCESS=PROCESS_NAME
| eval VOLUME=(BOTH+TABLE_VALUE)
| streamstats avg(VOLUME) as AVERAGE
| eval VARIATION=((1-(VOLUME/AVERAGE))*100)
| fieldformat VARIATION=round(VARIATION, 2)
| table PROCESS_NAMEVOLUMEAVERAGE VARIATION
| rangemap field=VARIATION low=0-20 elevated=20.01-50 severe=40.01-100 default=low
And we get results with different values for each table row, should be the same for this amount of data returned by this current search and time period.
