I have a search index=safes TransactionCode=DOPN OR TransactionCode=DCLO Details="Door A Opened" OR Details="Door A Closed"
| transaction open_close startswith=DOPN endswith=DCLO maxevents=2 | search eventcount=2
| stats count(duration) as Events by Location .
This gives me the number of relevant events by Location for the month I'm looking at. I want to display an average value line across the bar graph. However changing the last command to |stats count(duration) as Events, avg(Events) as Event_avg by Location doesn't create a value for Event avg and doesn't let me select Event avg as an overlay on the graph. I've seen many questions similar to this but the answers all seemed to refer to splitting up events by _time rather than some other field such as Location.