avg
Cortex XDR XQL comp avg aggregate returns the average value of an integer field in the result set.
Synopsis
comp avg(<field>) [as <alias>] by <field_1>,<field_2>
Description
The
avg
aggregation is a
comp function that returns the average value of an integer field, for all records that contain
matching values for the fields identified in the by
clause.
Examples
Return the sum of the
action_total_download
field for all records that have matching values for their
actor_process_image_path
and
actor_process_command_line
values:
dataset = xdr_data | fields actor_process_image_path as Process_Path, actor_process_command_line as Process_CMD, action_total_download as Download | filter Download > 0 | comp avg(Download) as average_download by Process_Path, Process_CMD
Recommended For You
Recommended Videos
Recommended videos not found.
