Return top, middle, and bottom returns from query results using stats

[arkmenster]

I have this query

index=x host=y "searchTerm" | stats Avg(Field1) Avg(Field2)

which returns a count of N statistics.

I would like modify my query such that

(first stats value) statistics[0], (middle stats value) ((statistics[0]+statistics[N])/length(statistics)), (final stats value) statistics(N)

are returned in the same query

I have tried using head and tail but that still limits it to the specified value after 'head' or 'tail'. What other options are available?

[ITWhisperer]

Please explain, with some examples, what is in "statistics", what you mean by "first", "last" and "middle" and how this relates to the two averages that your stats command is returning.

[arkmenster]

Thanks @ITWhisperer . So in the screenshot below, we see that 170 statistics were returned. I would like the query to return the 1st, the 85th/86th, and the 170th statistic, instead of all 170 of them. Is there a way to accomplish this?

sample

[ITWhisperer · Accepted solution]

| streamstats count as row
| eventstats max(row) as total
| where row = 1 OR row = total OR row = floor(total / 2)

[arkmenster]

Perfect. Thank you @ITWhisperer, your solution worked.