Hi Guys,
appendpipe [stats avg(*) as *]
, adds a new row with the average of all the rows of the respective column.
I wanted to get hold of this average value . So I didappendpipe [stats avg(*) as average(*)]
. So that I can use the "average" as a variable . This is all fine. The issue is when i do the appendpipe [stats avg(*) as average(*)]
, I get new columns added, with the names average(colname) and the row that existed before , with appendpipe [stats avg(*) as *]
gets deleted..
How do I keep the averages row as it is , still be able to use average(*)
, so that I can get the average value in a variable? is it possible?
I'm not quite sure I understand your question properly, so I'll take a stab in the dark. Are you trying to add horizontal average lines into a timechart?
If so, do something like this:
some search | timechart somethingorother | eventstats avg(*) as average(*)
That will add a field in the table / a line in your timechart graph called average(foo) for every field foo.
Now I'm sure I don't quite understand what you're ultimately trying to achieve.