sourcetype=syslog | timechart span=1m count by Protocol | streamstats sum() avg()
The result of this query is as follows:
(Time fields have been omitted.)
17 2 6 avg(17) avg(2) avg(6) sum(17) sum(2) sum(6)
4 0 30 4.0000 0.0000 30.0000 4 0 30
14 1 103 9.0000 0.5000 66.5000 18 1 133
21 0 5 13.000 0.3333 46.0000 39 1 138
22 1 0 15.250 0.5000 34.5000 61 2 138
20 0 12 16.200 0.4000 30.0000 81 2 150
11 1 32 15.333 0.5000 30.3333 92 3 182
sourcetype=syslog | timechart span=1m count by Protocol
| streamstats sum() avg()
| eval S/A=sum+avg
The results of this query as the table below and are stoked.
However, the results of the query does not appear.
17 2 6 avg(17) avg(2) avg(6) sum(17) sum(2) sum(6) S/A(17) S/A(2) S/A(6)
4 0 30 4.0000 0.0000 30.0000 4 0 30 ? ? ?
14 1 103 9.0000 0.5000 66.5000 18 1 133 ? ? ?
21 0 5 13.000 0.3333 46.0000 39 1 138 ? ? ?
22 1 0 15.250 0.5000 34.5000 61 2 138 ? ? ?
20 0 12 16.200 0.4000 30.0000 81 2 150 ? ? ?
11 1 32 15.333 0.5000 30.3333 92 3 182 ? ? ?
How do you create a query?
Do what kkolb says. Fieldnames can't be "S/A", it needs to be s_a.
or "s_a". From the documentation;
can you clarify that is your goal ?
also S/A may not be a valid field name, try "S/A"