How to multiply column values?

rslama — Thu, 20 Jun 2019 20:50:22 GMT

The way I do this in excel is by using the formula "=PRODUCT(C2*C3*C4*C5)"
How can I do that in Splunk?

Ideally, I want to do something like this:
search stuff

| foreach group
     [eval crossyield=PRODUCT(yield)]

Re: How to multiply column values?

kamlesh_vaghela — Fri, 21 Jun 2019 06:35:58 GMT

@rslama

You can achieve this scenario by playing with some awesome SPL commands. Can you please try this?

YOUR_SEARCH | eventstats list(Yield) as crossYield by Group | nomv crossYield | map search="| makeresults | eval s=\"$crossYield$\", s=split(s,\" \"), a=1 | mvexpand s | accum a | eval val_{a}=s | stats values(val_*) as val_* | eval crossYield=round(1,10) | foreach val_* [ eval crossYield=exact(crossYield * '<<FIELD>>') ] | eval Group=\"$Group$\",SubGroup=\"$SubGroup$\",Yield=\"$Yield$\" | table Group SubGroup Yield crossYield "

Sample Search:

| makeresults | eval _raw="Group    SubGroup    Yield
A   A.0 0.9
A   A.1 0.99
A   A.2 0.75
A   A.4 0.8
B   B.1 1
B   B.2 0.9
B   B.11    0.3
C   C.5 1
C   C.19    0.8" | multikv | table Group SubGroup Yield | eventstats list(Yield) as crossYield by Group | nomv crossYield | map search="| makeresults | eval s=\"$crossYield$\", s=split(s,\" \"), a=1 | mvexpand s | accum a | eval val_{a}=s | stats values(val_*) as val_* | eval crossYield=round(1,10) | foreach val_* [ eval crossYield=exact(crossYield * '<<FIELD>>') ] | eval Group=\"$Group$\",SubGroup=\"$SubGroup$\",Yield=\"$Yield$\" | table Group SubGroup Yield crossYield "

Thanks

Re: How to multiply column values?

rslama — Fri, 21 Jun 2019 21:51:29 GMT

Thank @kamlesh_vaghela
this works perfectly. but how do I change limit=0?
I am only getting 10 results in my statistics table.

Re: How to multiply column values?

rslama — Fri, 21 Jun 2019 22:19:02 GMT

NVM, I found the answer. I needed to set maxsearch

topic Re: How to multiply column values? in Splunk Search

How to multiply column values?

Re: How to multiply column values?

Re: How to multiply column values?

Re: How to multiply column values?