search SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID
I got the each session duration using the above command. Now how do I calculate the average of all those session duration??
if you only wanna show final result , just
SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID | stats avg(Session_Duraion_sec)
else if you wanna append to first result
SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID | append [ search SessionID="*" | stats range(_time) AS Session_Duration_sec by SessionID | stats avg(Session_Duraion_sec)]
Here I think the Splunk should expand some calculating functions to add rows like addcoltotals to summarize the table results. If some of this have been existed, please let me know. Thanks!!
just pipe it through stats again
| stats avg(Session_Duration_Sec)
/kristian