Let us say I have 5 unique fields in my logs (var1 thru var5), I would like to first find the mean of the individual fields ( avg(var*) ) and store them in a new field, say "avg_var". Then, I would like to get the difference of max(avg_var) and min(avg_var).
The following search provides me a table of the 1st part, but then I don't know how to get the min and max of the 5 unique fields.
sourcetype="src" var* | stats avg(var*) BY unitNo
result:
unitNo, avg(var1), avg(var2), avg(var3), avg(var4), avg(var5)
1, 12, 32, 63, 13, 45
..
..
Any help would be very much appreciated.
... View more