total average number rather than average by field

[andrwbn]

I have the query set up to find the average duration per country. How would I get the query to find the total average duration of all the countries together?

[hunters_splunk · Accepted solution]

Hi andrwbn,

Either one of the following can help you get the total average duration of all countries:

• Remove "by country" in our query
  Change:

  ... | stats avg(duration) by country
  
  To:

  ... | stats avg(duration)

• Use the addcoltotals command to view both by-country averages and total averages at the same time

  ... | stats avg(duration) by country | addcoltotals
  Hope this helps. Thanks!
  Hunter

[rjthibod]

The community can best help you if you share the query or at least part of it. Please copy and paste what you can from the actual query.

[skoelpin]

Without seeing your query, this is hard to say. But I'm betting you're using the BY clause to sort the average by country. Remove the BY COUNTRY to get the total average