topic Re: Math function on stats count in Splunk Search

Math function on stats count

anz999 — Wed, 30 Sep 2020 04:53:29 GMT

I would like to do some math operation of retrieved count of each values.

Eg: 318*5.5 + 418*2.5 + 54*5 + 83*2 and get the total from the resulted output(SS attached)

Query used:-

index=omi_qa host=DEFRNC* sourcetype=all_events_custom_attributes SEVERITY IN (CRITICAL,MAJOR,MINOR) OR (SEVERITY=WARNING AND APPLICATION=NNMi) | eval {idx} = elt
| stats latest(CLIP) as CLIP, values(UMN) as UMN by ID | lookup clipUMNs.csv UMN OUTPUTNEW Solution
| search CLIP != "NULL" AND CLIP != "TRUE"
| where Solution = "Escalation"

Re: Math function on stats count

richgalloway — Tue, 07 Apr 2020 17:27:47 GMT

Where do the multipliers (5.5. 2.5, 5, 2) come from?

Re: Math function on stats count

anz999 — Tue, 07 Apr 2020 17:50:07 GMT

It comes from the lookup file. Field name is FTE

Re: Math function on stats count

richgalloway — Tue, 07 Apr 2020 18:38:10 GMT

Perhaps this will help.

index=omi_qa host=DEFRNC* sourcetype=all_events_custom_attributes SEVERITY IN (CRITICAL,MAJOR,MINOR) OR (SEVERITY=WARNING AND APPLICATION=NNMi) | eval {idx} = elt
| stats latest(CLIP) as CLIP, values(UMN) as UMN cout as Count by ID | lookup clipUMNs.csv UMN OUTPUTNEW Solution FTE
| search CLIP != "NULL" AND CLIP != "TRUE"
| where Solution = "Escalation"
| eval Product = Count * FTE
| addcoltotals labelfield= ID label="Grand Total" Product