Is it possible, within the same search, to find the count of events where the transaction duration is greater than and less than the average?

[vamshi245]

I am trying to get the count of events where the transaction duration is above the average duration and below the average duration.

below is my search to find out the count of events above the average transaction duration:

index=whatever*  sourcetype="Source"  "COMPONENTNAME=X" AND "EVENT=Received"|eval receivedtime=SERVER_TIME |join type=inner ORDERNUMBER max=0[search index=tas_prod  sourcetype="TAS:FUSION:ProdSupport:PRD:AuditDB"  "COMPONENTNAME=Y" AND "EVENT=Delivered"|eval deliveredTime=SERVER_TIME ]|eval diff = deliveredTime-receivedtime| eventstats avg(diff) as Avg | where diff>Avg| stats count as Grt

is it possible to get the count of transactions with diff < Avg in the same search? like:

searchStatement|eval diff = deliveredTime-receivedtime| eventstats avg(diff) as Avg | where diff>Avg| stats count as Grt | where diff < Avg |stats count as Lsr

please let me know if i can combine the count without using the same search statement another time to find the count for less than average

[sundareshr · Accepted solution]

You could try this

.... | stats count(eval(diff>Avg)) as Grt count(eval(diff<Avg)) as Lsr

[vamshi245]

thanks this worked.