So I have a some data that I've put into a chart. For the purposes of this question lets say the data is in the form "Username Purchases"
userA 400
userB 800
userA 150
userZ 900
userA 350
userB 700
How do I create a chart that charts total number of purchases for each user and then a average value across all users as the final column?
So far I have:
sourcetype=data | chart sum(purchases) by username
But I don't know how to average out and insert that last average value.
But what if I use the APPEND?
sourcetype=data | chart avg(purchases) by username | append [search sourcetype=data |eval username="allUserAverage" |chart avg(purchases) by username ]
Try
sourcetype=data | eventstats sum(purchases) as total|stats sum(purchases) as sum by username|eval percent=(sum/total)
From my understanding of your question, would it just be like this?
sourcetype=data | chart sum(purchases), avg(purchases) by username
That's not quite what I'm looking for. I am looking for a bar chart but based on the data the feeding it, the chart would look like:
userAaverage = 300
userBaverage = 750
userZaverage = 900
allUserAverage = 550
So four columns in total