calculating average that depends on the value of one field

[almond14]

I have this list of events:
1. dir=up, time=60, speed=12, weight=92
2. dir=down, time=54, speed=16, weight=32
3. dir=up, time=69, speed=10, weight=66
4. dir=up, time=99, speed=84, weight=47
5. dir=down, time=66, speed=88, weight=11
6. dir=up, time=17, speed=62, weight=82
etc

How do I create a chart/table with these columns:
<average time (up)> < average time (down)> <average speed (up)> <average speed (down)> <average weight (up)> <average weight (down)>

[jplumsdaine22 · Accepted solution]

Something like this should give you what you're after

<your search> | eventstats avg(time) as avgtime avg(speed) as avgspeed avg(weight) as avgweight by dir | dedup dir |eval avgtime_{dir}=avgtime | eval avgspeed_{dir}=avgspeed | eval avgweight_{dir}=avgweight  | chart values(avg*) as avg*

[stephanefotso]

Hello. Try this:

index=....... dir="up"|stats sum(time) as sum_time_up sum(speed) as sum_speed_up sum(weight) as sum_weight_up|eval average_time_up=time/sum_time_up|eval average_speed_up=speed/sum_speed_up|eval average_weight_up=weight/sum_weight_up|join [search index=... dir="down"|stats sum(time) as sum_time_down sum(speed) as sum_speed_down sum(weight) as sum_weight_down|eval average_time_down=time/sum_time_down|eval average_speed_down=speed/sum_speed_down|eval average_weight_down=weight/sum_weight_down]|table  average_time_up  average_time_down  average_speed_up average_speed_down average_weight_up average_weight_down

Thanks