Missing Stats Data

[jkwilling]

When mean & avg are both present on a "stats" search, the first one in order will be missing so:

| makeresults count=100 | eval Value=random() % 100
| Stats count(Value) AS Count avg(Value) AS Avg mean(Value) AS Mean

results in:

Count	Avg	Mean
100		49.49

While

| makeresults count=100 | eval Value=random() % 100
| Stats count(Value) AS Count mean(Value) AS Mean avg(Value) AS Avg

results in:

Count	Mean	Avg
100		43.78

So why is one of the values missing?

John W.

[bowesmana]

As @richgalloway says, mean and average are the same, so it's a pointless aggregation.

| makeresults count=100 | eval Value=random() % 100, Value2=Value
| Stats count(Value) AS Count avg(Value2) AS Avg mean(Value) AS Mean

Making Value2 as Value, will give you both aggregations, but as you can see they are the same.

[richgalloway]

mean() and avg() are the same so perhaps stats just takes the last one specified.  If you only use one of those functions then you won't have any "missing" data. 😀

[jkwilling]

Now that you pointed it out, I should have know that Mean/Avg are the same....

I was just playing with extracting all of the aggregate functions and just noticed the conditions and thought that I would report it.

Thanks,

John