I have a timechart that shows me the daily throughput for a log source per indexer. I'm trying to find a way to add the average at the bottom for each column of the chart to show me the daily average per indexer. There is a command called "addcoltotal", but I'm looking for the average.
index=_internal source="*metrics.log" group=per_source_thruput series=network earliest=-30d | eval dailyGB=(kb/1024000) | timechart span=1d sum(dailyGB) by host
_time indexer1 index2 indexer3
1 3/7/12 12:00:00.000 AM 7.86325036907982 8.8324329432009 3.432423543254
2 3/8/12 12:00:00.000 AM 55.2752835159227 0.1303261899898 2.134345324324
3 3/9/12 12:00:00.000 AM 53.2091017865928 4.8808330507275 5.6209532661776
4 3/10/12 12:00:00.000 AM 17.6108422803661 5.2928352422775 3.5238746919151
Average: # # #
You can use appendpipe to append an average:
index=_internal source="*metrics.log" group=per_source_thruput series=network earliest=-30d
| eval dailyGB=(kb/1024000)
| timechart span=1d sum(dailyGB) by host
| appendpipe [stats avg(*) as *]
In general, you can use plain old | append [...]
and put the whole search, index=_internal source="*metrics.log" group=per_source_thruput series=network earliest=-30d
, in the subsearch.
| eval dailyGB=(kb/1024000)
| timechart span=1d sum(dailyGB) by host
| stats avg(*) as *
appendpipe is only available in 4.3. Any solution for 4.1.8?