how to add column averages to a timechart

[michaeljlancast]

I have a timechart that shows me the daily throughput for a log source per indexer. I'm trying to find a way to add the average at the bottom for each column of the chart to show me the daily average per indexer. There is a command called "addcoltotal", but I'm looking for the average.

index=_internal source="*metrics.log" group=per_source_thruput series=network earliest=-30d | eval dailyGB=(kb/1024000) | timechart span=1d sum(dailyGB) by host

        _time                   indexer1          index2           indexer3
    1   3/7/12 12:00:00.000 AM  7.86325036907982  8.8324329432009  3.432423543254   
    2   3/8/12 12:00:00.000 AM  55.2752835159227  0.1303261899898  2.134345324324
    3   3/9/12 12:00:00.000 AM  53.2091017865928  4.8808330507275  5.6209532661776
    4   3/10/12 12:00:00.000 AM 17.6108422803661  5.2928352422775  3.5238746919151
    Average:                    #                 #                #

[Stephen_Sorkin]

You can use appendpipe to append an average:

index=_internal source="*metrics.log" group=per_source_thruput series=network earliest=-30d
| eval dailyGB=(kb/1024000)
| timechart span=1d sum(dailyGB) by host
| appendpipe [stats avg(*) as *]

[Stephen_Sorkin]

In general, you can use plain old | append [...] and put the whole search, index=_internal source="*metrics.log" group=per_source_thruput series=network earliest=-30d
| eval dailyGB=(kb/1024000)
| timechart span=1d sum(dailyGB) by host
| stats avg(*) as *, in the subsearch.

[michaeljlancast]

appendpipe is only available in 4.3. Any solution for 4.1.8?