Yes. You can do this by using appendpipe instead of addtotals .
Before the evals, add:
appendpipe [stats sum(NbrRecords) as NbrRecords avg(AvgRunTime) as AvgRunTime min(MinRunTime) as MinRunTime max(MaxRunTime) as MaxRunTime]
EDIT: A comment points out, quite correctly, that it's not valid to take the average of an average.
We can correctly compute the average in one of two different ways.
The first is to have the first stats compute the sufficient statistics for average, say by changing that pair of lines into:
| stats count(nbrSeconds) as NbrReports, sum(nbrSeconds) as SumRunTime, min(nbrSeconds) as MinRunTime, max(nbrSeconds) as MaxRunTime by User
| appendpipe [stats sum(NbrRecords) as NbrRecords sum(SumRunTime) as SumRunTime min(MinRunTime) as MinRunTime max(MaxRunTime) as MaxRunTime]
| eval AvgRunTime = SumRunTime/NbrRecords
| fields - SumRunTime
We actually could have done this just using the appendpipe above, slightly more opaquely:
appendpipe [eval SumRunTime=AvgRunTime*NbrRecords | chart sum(NbrRecords) as NbrRecords eval(sum(SumRunTime)/sum(NbrRecords)) as AvgRunTime min(MinRunTime) as MinRunTime max(MaxRunTime) as MaxRunTime]
The other, perhaps better way, is to make use of multivalued fields. First, we augment the User with a grand total line, and then let stats do the rest. In this case, we use the full search:
...
| eval User = UserName." --- ".UserId . ";;ALL"
| convert mstime(TotalReportRunTime) AS nbrSeconds
| makemv delim=;; User
| stats count as NbrReports, avg(nbrSeconds) as AvgRunTime, min(nbrSeconds) as MinRunTime, max(nbrSeconds) as MaxRunTime by User
| eval User = if(User == "ALL", null(), User)
| sort - User
| eval AvgRunTime = strftime(AvgRunTime, "%M:%S.%3N")
| eval MinRunTime = strftime(MinRunTime, "%M:%S.%3N")
| eval MaxRunTime = strftime(MaxRunTime, "%M:%S.%3N")
... View more