How to edit my current search to find the average?

[vtsguerrero]

Hello guys! Sup?
Can anyone help me to get the average of all current search events and not only the first ones. I have this search below which has everything I need, but just missin' the correct average. How can I achieve the correct average and variation:

index=main sourcetype=main_pc BOTH=* TABLE_VALUE=* PROCESS_NAME=* 
| eval PROCESS=PROCESS_NAME
| eval VOLUME=(BOTH+TABLE_VALUE)  
| streamstats avg(VOLUME) as AVERAGE
| eval VARIATION=((1-(VOLUME/AVERAGE))*100) 
| fieldformat VARIATION=round(VARIATION, 2) 
| table PROCESS_NAMEVOLUMEAVERAGE VARIATION
| rangemap field=VARIATION low=0-20 elevated=20.01-50 severe=40.01-100 default=low

And we get results with different values for each table row, should be the same for this amount of data returned by this current search and time period.

[maciep]

Maybe you want to use eventstats instead of streamstats?

http://blogs.splunk.com/2014/04/01/search-command-stats-eventstats-and-streamstats-2/