I have the following in my query index=_internal source=license_usage.log | eval sizemb=b/1024/1024 timechart span=1d sum(sizemb) by host limit= 10 | appendpipe [stats avg() as *]
The last bit as we know adds the last row with the averages of all the days.. Is there a way I can get hold of this average value? someway I can keep this value in the eval variable.. I need this avg of cols to check entry of each day against the average… I need to compare the day1 entry with the average.. Is this possible?
dakT