I have a search index=safes TransactionCode=DOPN OR TransactionCode=DCLO Details="Door A Opened" OR Details="Door A Closed"
.
| transaction open_close startswith=DOPN endswith=DCLO maxevents=2 | search eventcount=2
| stats count(duration) as Events by Location
This gives me the number of relevant events by Location for the month I'm looking at. I want to display an average value line across the bar graph. However changing the last command to |stats count(duration) as Events, avg(Events) as Event_avg by Location
doesn't create a value for Event avg and doesn't let me select Event avg as an overlay on the graph. I've seen many questions similar to this but the answers all seemed to refer to splitting up events by _time
rather than some other field such as Location.
Add at the end...
| eventstats avg(Events) as Event_avg
That will put the same overall average on every event.
Haven't done overlays myself, so that only gets you halfway there, but the data will be available anyway.
Add at the end...
| eventstats avg(Events) as Event_avg
That will put the same overall average on every event.
Haven't done overlays myself, so that only gets you halfway there, but the data will be available anyway.