you can’t disaggregate
Had a customer recently ask about to disaggregate a Splunk search that had aggregated fields because they export to CSV horribly. Here’s the thing. You can’t disaggregate aggregated fields. And there’s a Good Reason™ too: aggregation, by definition, is a one-way street. You can’t un-average something. Average is an aggregation function. So why would you…