https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342793#M101540 <P>This answer is very helpful and I've upvoted the answer - thank you! However, as it stands, both answers are equally valid, so I'm leaving it to the community to vote on them. </P> Fri, 09 Mar 2018 18:38:20 GMT flow2k 2018-03-09T18:38:20Z https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342789#M101536 <P>If I wanted a count of all the events in all my indices, I can just do:<BR /> <CODE>index=* | stats count</CODE>, which just returns a single number in a single row with this value.</P> <P>But say I wanted to customize the stats function - say I want to add 2 to the count returned:<BR /> <CODE>index=* | stats count+2</CODE> is invalid.</P> <P>How can I customize an aggregate statistics function with simple math operations?</P> Thu, 08 Mar 2018 21:14:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342789#M101536 flow2k 2018-03-08T21:14:43Z https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342790#M101537 <P>Try this</P> <PRE><CODE>| metasearch index=* | stats count | eval count='count'+2 </CODE></PRE> <P>You need to use an <CODE>eval</CODE> to do basic mathematical calculations </P> <P><CODE>Metasearch</CODE> will look at your index time fields and search 10x faster than doing <CODE>index=*</CODE></P> Thu, 08 Mar 2018 21:42:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342790#M101537 skoelpin 2018-03-08T21:42:39Z https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342791#M101538 <P>index=* | stats count AS count| eval count = count + 2</P> Thu, 08 Mar 2018 21:44:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342791#M101538 damiensurat 2018-03-08T21:44:33Z https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342792#M101539 <P>Please accept the answer if this helped you</P> Fri, 09 Mar 2018 00:38:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342792#M101539 skoelpin 2018-03-09T00:38:25Z https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342793#M101540 <P>This answer is very helpful and I've upvoted the answer - thank you! However, as it stands, both answers are equally valid, so I'm leaving it to the community to vote on them. </P> Fri, 09 Mar 2018 18:38:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342793#M101540 flow2k 2018-03-09T18:38:20Z https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342794#M101541 <P>In the Splunk community, users accept answers that helped them solve their problem. This signals a correct answer for users who may look at this in the future. Since both answers are valid, it's fair to accept the one that helped more and/or who answered first, which in this case is this one. </P> <P>Top contributors on this forum would also be reluctant to answer your future questions if your known not to accept the correct answers</P> Fri, 09 Mar 2018 19:10:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342794#M101541 skoelpin 2018-03-09T19:10:19Z https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342795#M101542 <P>I downvoted this post because refusing to accept a correct answer leaves unanswered spam on the board.</P> Fri, 09 Mar 2018 22:04:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-customize-stats-using-simple-math/m-p/342795#M101542 davpx 2018-03-09T22:04:04Z