When mean & avg are both present on a "stats" search, the first one in order will be missing so:
| makeresults count=100 | eval Value=random() % 100
| Stats count(Value) AS Count avg(Value) AS Avg mean(Value) AS Mean
results in:
Count | Avg | Mean |
100 | 49.49 |
While
| makeresults count=100 | eval Value=random() % 100
| Stats count(Value) AS Count mean(Value) AS Mean avg(Value) AS Avg
results in:
Count | Mean | Avg |
100 | 43.78 |
So why is one of the values missing?
John W.
As @richgalloway says, mean and average are the same, so it's a pointless aggregation.
| makeresults count=100 | eval Value=random() % 100, Value2=Value
| Stats count(Value) AS Count avg(Value2) AS Avg mean(Value) AS Mean
Making Value2 as Value, will give you both aggregations, but as you can see they are the same.
mean() and avg() are the same so perhaps stats just takes the last one specified. If you only use one of those functions then you won't have any "missing" data. 😀
Now that you pointed it out, I should have know that Mean/Avg are the same....
I was just playing with extracting all of the aggregate functions and just noticed the conditions and thought that I would report it.
Thanks,
John