I am building a search to find the average amount of time an action takes:
sourcetype="timelog" | stats avg(request_duration) by requested_file
However, I would also like to see the number of hits represented in that average which I would intuitively write like so:
sourcetype="timelog" | stats avg(request_duration), count(request_duration) by requested_file
Of course, this is invalid syntax because stats only allows one input column.
What is the proper way to write this search?
The stats
command allows many input columns and many aggregation functions on any or all of them. The above syntax is valid and correct for what you have stated.