index="sc-general" info AND(heartbeat OR Successfully) NOT(created) | rex ":\s+(?\w+)" | eval entry_type=if(entry_type == "Successfully", "File", entry_type) | timechart count by entry_type
Now, I want to calculate average of each event type on this chart. help me with this
Your search came through a bit garbled, but I believe you can just change your timechart at the end to
| timechart count, avg(MyField) by entry_type
filling in whatever "MyField" that you wanted to average was.
If this worked for you, could you please Accept the Answer so that others searching here will benefit?
Thanks!
Rich