That probably doesn't represent your data. stats avg works perfectly fine on what you posted.
Are you sure that the real data doesn't contain a NULL value for the numerical field ?
Example with NULL data:
* | head 2 | eval user="john" | streamstats count as count| eval num=if(count==2,20,NULL) | table user num | eventstats avg(num) as avg by user
With non-null-data :
* | head 2 | eval user="john" | streamstats count as count| eval num=if(count==2,20,0) | table user num | eventstats avg(num) as avg by user
You want to look at fillnull
... View more