This operation calculates the average of the values found in a specified numeric column for each grouping occurrence. If you want to exclude null values from the calculation, you can use the Non-null average (nnavg) operation.
How does it work in the search window?
Before being able to perform this operation, you have to group your data. Be aware that the columns used as arguments for the grouping operation will not be available to select as arguments for the aggregation operation.
After grouping the data, select Aggregation in the search window toolbar, then select the Average operation. You need to specify one argument:
|Average of (mandatory)||integer, float|
The data type of the aggregated values is integer or float.
siem.logtrust.web.activity table, we want to calculate the average of the response length during each 5-minute period. Before aggregating the data, the table must be grouped in 5-minute intervals. Then we will perform the aggregation using the Average operation.
The arguments needed for the Average operation are:
- Average of → responseLength column
Click Aggregate function and you will see the following result:
How does it work in LINQ?
Group your data using the following structure:
as... to add the new column that will show the aggregated values. This is the syntax for the Average operation:
See Build a query using LINQ to learn more about grouping and aggregating your data using the LINQ language.
You can copy the following LINQ script and try the example above on the
from siem.logtrust.web.activity group every 5m every 5m select avg(responseLength) as responseLength_avg
In case you want to try another example with arguments when grouping, you have the query below. In the
demo.ecommerce.data table, you will see the average of bytesTransferred for each method-statusCode unique occurrence every 10-minute period.
from demo.ecommerce.data group every 10m by statusCode, method every 10m select avg(bytesTransferred) as bytes_average