sourcetype="email_process" | eval processing_time_in_seconds = processing_time/1000 | table email, processing_time ,processing_time_seconds | chart sum(processing_time_seconds), count(processing_time) by email The output of this is email sum(processing_time_seconds) count(processing_time) a@xx.com 1000 2 b@xx.com 2000 10 I would like to add another column called average_time that lists average_time for each email. Note average_time=sum(processing_time_seconds) / count(processing_time) Desired output email sum(processing_time_seconds) count(processing_time) Avg_Time_millisecond a@xx.com 1000 2 500 b@xx.com 2000 10 200 ... View more