How to get average value of fields?

[sekhar463]

hi all,

i have some events with a field called RUNTIME for each job.

how can i get the average value of RUNTIME for each of the job and result will be on new field

[yuanliu]

I assume "results will be new field" means that you want the average along with raw events.  In this case, eventstats is your friend.

| eventstats avg(RUNTIME) AS RUNTIME_avg BY JOID

[gcusello]

Hi @sekhar463 ,

pease try something like this:

<your_search>
| stats avg(RUNTIME) AS RUNTIME_avg BY JOID

Ciao.

Giuseppe

[ITWhisperer]

| stats avg(RUNTIME) as average_runtime