I assume "results will be new field" means that you want the average along with raw events. In this case, eventstats is your friend.
| eventstats avg(RUNTIME) AS RUNTIME_avg BY JOID
Hi @sekhar463 ,
pease try something like this:
<your_search>
| stats avg(RUNTIME) AS RUNTIME_avg BY JOID
Ciao.
Giuseppe
| stats avg(RUNTIME) as average_runtime