appendpipe variable

[daktapaal]

Hi Guys,

appendpipe [stats avg(*) as *], adds a new row with the average of all the rows of the respective column.
I wanted to get hold of this average value . So I didappendpipe [stats avg(*) as average(*)] . So that I can use the "average" as a variable . This is all fine. The issue is when i do the appendpipe [stats avg(*) as average(*)] , I get new columns added, with the names average(colname) and the row that existed before , with appendpipe [stats avg(*) as *] gets deleted..

How do I keep the averages row as it is , still be able to use average(*) , so that I can get the average value in a variable? is it possible?

[martin_mueller]

I'm not quite sure I understand your question properly, so I'll take a stab in the dark. Are you trying to add horizontal average lines into a timechart?

If so, do something like this:

some search | timechart somethingorother | eventstats avg(*) as average(*)

That will add a field in the table / a line in your timechart graph called average(foo) for every field foo.

[martin_mueller]

Now I'm sure I don't quite understand what you're ultimately trying to achieve.