https://community.splunk.com/t5/Splunk-Search/How-to-multiply/m-p/444966#M191209 <P>Hi, </P> <P>Can someone please help me with this query? I am trying to multiply the fields Batch_Size and count and return the results in the tc field. I tried the above syntax but it did not work. </P> <P>The first three lines of this query work fine by itself. After adding the lines 4,5, it does not return anything. </P> <PRE><CODE>"\(TOTAL_REC\)::" |rex field=_raw "(\(TOTAL_REC\)::)(?P\s(\d))" |stats count by Batch_Size | eval tc = Batch_Size*count | stats sum(tc) as tc </CODE></PRE> <P>Any help will be appreciated. </P> <P>Thanks, Ro,</P> Tue, 13 Aug 2019 12:23:02 GMT rlaul 2019-08-13T12:23:02Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply/m-p/444966#M191209 <P>Hi, </P> <P>Can someone please help me with this query? I am trying to multiply the fields Batch_Size and count and return the results in the tc field. I tried the above syntax but it did not work. </P> <P>The first three lines of this query work fine by itself. After adding the lines 4,5, it does not return anything. </P> <PRE><CODE>"\(TOTAL_REC\)::" |rex field=_raw "(\(TOTAL_REC\)::)(?P\s(\d))" |stats count by Batch_Size | eval tc = Batch_Size*count | stats sum(tc) as tc </CODE></PRE> <P>Any help will be appreciated. </P> <P>Thanks, Ro,</P> Tue, 13 Aug 2019 12:23:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply/m-p/444966#M191209 rlaul 2019-08-13T12:23:02Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply/m-p/444967#M191210 <P>When you do a stats command (line 3), the fields visible before it become inaccessible. One way to solve your question:</P> <PRE><CODE>"\(TOTAL_REC\)::" |rex field=_raw "(\(TOTAL_REC\)::)(?P\s(\d))" |stats count AS Volume BY Batch_Size | eval tc = Batch_Size*Volume </CODE></PRE> <P>This creates a new field, but you need a field name (Volume) in your stats command for it to work.</P> Tue, 13 Aug 2019 13:16:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply/m-p/444967#M191210 jpolvino 2019-08-13T13:16:20Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply/m-p/444968#M191211 <P>could you pls post the output of first 3 lines?</P> Tue, 13 Aug 2019 15:59:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply/m-p/444968#M191211 mayurr98 2019-08-13T15:59:59Z