splunksplunk-querysplunk-calculationsplunk-formula

How to multiply value from previous command to some constant?

I am doing a query such that it will take the total count of the a value and then multiply it by some constant. For example :

source="test.csv"  sourcetype="csv" | stats count(adId)

I want to multiply the result returned by the count by 0.5. Suppose if the output by stats count is 124 I want to multiply it by 0.5 and report the output.

Solution

  • Use eval. First have stats put its result in a better-named field. I also use exact for better precision and round to control the number of decimal places.

    source="test.csv"  sourcetype="csv" 
| stats count(adId) as interim 
| eval output = round(exact(interim * 0.5), 3)

    You could do it without an interim field, if you wish.

    source="test.csv"  sourcetype="csv" 
| stats count(adId) as output
| eval output = round(exact(output * 0.5), 3)