The averaging function (
avg) calculates the average value of the numerical field being evaluated within the time range analyzed.
avg(<numerical_field>) [as <field>] [by <field>]
- Creates field named
Parse milliseconds and calculate average
This example query parses the number of milliseconds and calculates the average across the search time range.
| parse "time taken: * ms," as time
| avg(time) as avg_time
An example snippet from a log would like this:
time taken: 21 ms, where the value parsed from
time taken would be 21, which in this case is in milliseconds.
The average operator would calculate against all parsed values and return the average, which would be returned in the Aggregates tab as a number, such as 50.
Use Aggregate in Query
This example shows you how to use more than one aggregate operator like avg in a query. This is useful when you need to calculate the average of more than one field.
When multiple aggregates are used you need to create an alias using the as operator so they each get a unique field name. For example,
| avg(time) as avg_time, avg(_size) as logSize