How to apply operator on a specific value in a table?

dyeo — Sat, 27 Apr 2019 02:24:23 GMT

I'm trying to divide a specific value in a table by 10. What is the best way to do this?

My search:
(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz (Failure_Reason="Unknown user name or bad password.")) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff sourcetype=www action=failure) | eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName) | eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E") | stats dc(output) as count by descrip

I would like to divide only the count value in row B by 10. Is this possible?

Thank you!

Re: How to apply operator on a specific value in a table?

woodcock — Sat, 27 Apr 2019 03:42:24 GMT

Just add this:

... | eval count=if(descrip="B", count/10, count)

Re: How to apply operator on a specific value in a table?

dyeo — Sat, 27 Apr 2019 03:56:56 GMT

Thanks, that worked!

topic Re: How to apply operator on a specific value in a table? in Splunk Search

How to apply operator on a specific value in a table?

Re: How to apply operator on a specific value in a table?

Re: How to apply operator on a specific value in a table?