CODEWITHSUNDEEP
splunksplunk-querysplunk-calculationsplunk-formula
Atif Imam
Atif Imam

Reputation: 49

How to multiply value from previous command to some constant?

I am doing a query such that it will take the total count of the a value and then multiply it by some constant. For example :

source="test.csv"  sourcetype="csv" | stats count(adId)

I want to multiply the result returned by the count by 0.5. Suppose if the output by stats count is 124 I want to multiply it by 0.5 and report the output.

Upvotes: 1

Views: 681

Answers (1)

RichG
RichG

Reputation: 9926

Use eval. First have stats put its result in a better-named field. I also use exact for better precision and round to control the number of decimal places.

source="test.csv"  sourcetype="csv" 
| stats count(adId) as interim 
| eval output = round(exact(interim * 0.5), 3)

You could do it without an interim field, if you wish.

source="test.csv"  sourcetype="csv" 
| stats count(adId) as output
| eval output = round(exact(output * 0.5), 3)

Upvotes: 3

Related Questions