How to get average value of fields?

[sekhar463]

hi all,

i have some events with a field called RUNTIME for each job.

how can i get the average value of RUNTIME for each of the job and result will be on new field

2022-12-14 08:10:00.995, JOID="105459", JOB_NAME="PNC-UIT-INVOBT-STANDARD-TEST-125", JOB_GROUP="UIT", TIMEZONE="Central", RUN_NUM="403676470", NTRY="1", RUN_MACHINE="usappasyswp125", STATUS_CODE="4", STATUS="SUCCESS", STATUS_TIME="2022/12/14 05:33:49", LAST_START="2022/12/14 05:33:20", LAST_END="2022/12/14 05:33:48", DATE_CONDITIONS="0", RUNTIME="28", EXIT_CODE="0"

[yuanliu]

I assume "results will be new field" means that you want the average along with raw events.  In this case, eventstats is your friend.

| eventstats avg(RUNTIME) AS RUNTIME_avg BY JOID

[gcusello]

Hi @sekhar463 ,

pease try something like this:

<your_search>
| stats avg(RUNTIME) AS RUNTIME_avg BY JOID

Ciao.

Giuseppe

[ITWhisperer]

| stats avg(RUNTIME) as average_runtime