avg value of a field based on the range of another field

[Da_Vicki]

Logs :

Size    ExecValue
3       400
4       200 
13      150
2       300

Output:

     Size      avg(ExecValue)   max(ExecValue)
     0-5       300              400 
     6-10      0                0
    11-15     150               150

How can i achieve the above result?

[martin_mueller · Accepted solution]

Sure, you can do this:

base search | bin span=5 Size | stats avg(ExecValue) max(ExecValue) by Size | makecontinuous Size | fillnull

Here's a dummy query generating sample data to test:

| stats count | eval value = "2 3 4 13" | makemv value | mvexpand value | eval foo = random() % 100 | bin span=5 value | stats avg(foo) max(foo) by value | makecontinuous value | fillnull

Dummy output:

    value   avg(foo)  max(foo)
1     0-5 53.000000         73
2    5-10         0          0
3   10-15 95.000000         95