I am investigating failed logins. I need to perform a count of all failed logins by user, take an average of that count, and then only show results that are higher than the average. index=windows fail* | stats earliest(_time) as "Earliest Failure", latest(_time) as "Latest Failure", count by user | *Need to Average the count here* | convert ctime("Earliest Failure") ctime("Latest Failure") | where count > *Average* | table user "Earliest Failure" "Latest Failure" count | sort -count Thanks in advance! ... View more