Hi
i have a field say A with values as below.
A
10
20
30
i have used the eval function like this .. eval RES= ( sum(A)/mvcount(A)) . but it didnt work ?? i need to take the avg of these values .. how can i do it using eval without using stats avg function ...
Note that an eval
only works on fields in a single event. That means that unless field A is multi-value in a single event, something like mvcount(A) will only ever be one (1). If you use eventstats as described below, then the total (or other values) can be carried per event, and would then be in play for an eval
statement.
I think you are trying to avoid aggregation while still computing aggregate fields. Use the eventstats command to get the best of both worlds:
|eventstats avg(A) as average_A
This adds an average_A field to every result.
By the way, if you still want to use eval, you can combine the two:
|eventstats sum(A) as suma, count |eval avgA = suma/count
why do you need to do it without using stats?