https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586844#M204390 <P>this one didnt quite work...</P> Mon, 28 Feb 2022 13:37:46 GMT Thail 2022-02-28T13:37:46Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586465#M204289 <P>Might be simple, but i run a search for tags and values and i get the information. What is the proper syntax to multiply one event value by another event value?</P> <P>Thanks in advance.</P> Thu, 24 Feb 2022 18:39:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586465#M204289 Thail 2022-02-24T18:39:43Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586475#M204291 <P>There isn't one.&nbsp; Events are treated separately so Splunk can't work with values from different events.&nbsp; Exceptions exist for certain functions (range, for instance) in aggregating commands.</P><P>Tell us more about the problem you're trying to solve and perhaps we can suggest a solution.</P> Thu, 24 Feb 2022 18:52:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586475#M204291 richgalloway 2022-02-24T18:52:36Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586646#M204343 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Thail_0-1645813312583.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/18139iE07BEA333A6B61CA/image-size/medium?v=v2&amp;px=400" role="button" title="Thail_0-1645813312583.png" alt="Thail_0-1645813312583.png" /></span></P><P>I just want to be able to multiply these two values without needing to do it at the PLC level</P> Fri, 25 Feb 2022 18:22:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586646#M204343 Thail 2022-02-25T18:22:53Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586654#M204345 <P>Those two events will have to be combined into a single event so Splunk can "see" both values at the same time and work with them.&nbsp; One problem, however, is there appears to be nothing in common between the events that would tell Splunk they should be joined.&nbsp; Can you elaborate on the use case, please?</P> Fri, 25 Feb 2022 19:22:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586654#M204345 richgalloway 2022-02-25T19:22:03Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586666#M204349 <P>Only 2 tags from the plc to multiply to get "production per hour"</P> Fri, 25 Feb 2022 20:47:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586666#M204349 Thail 2022-02-25T20:47:19Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586680#M204352 <P>If there are only 2 results then this should do the job.</P><LI-CODE lang="markup">index=foo Tag="Twin_PLC.Twin_PLC.Global.ProdTrend" | rename Value was ProdTrend | appendcols [ index=foo Tag="Board Edger.Edger_PLC.Global.DailyBlkAvg" | rename Value as DailyBlkAvg ] | eval product=ProdTrend * DailyBlkAvg | table ProdTrend DailyBlkAvg product</LI-CODE><P>If there are more than 2 results then Splunk will need to know how to pair them so the calculations are accurate.</P> Sat, 26 Feb 2022 00:29:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586680#M204352 richgalloway 2022-02-26T00:29:01Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586844#M204390 <P>this one didnt quite work...</P> Mon, 28 Feb 2022 13:37:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586844#M204390 Thail 2022-02-28T13:37:46Z https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586860#M204397 <P>I can't see your screen from here so you'll have to write down what results you got and what results you expected to get.</P> Mon, 28 Feb 2022 15:20:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-multiply-one-event-value-by-another-event-value/m-p/586860#M204397 richgalloway 2022-02-28T15:20:07Z