https://community.splunk.com/t5/Splunk-Search/How-to-iterate-a-value-in-ColumnA-through-all-values-in-ColumnB/m-p/173483#M49757 <P>If the column isnt multivalues, you can use streamstats to capture what the first value of the column is and use it to calculate the new column.</P> <PRE><CODE>... | streamstats first(columnA) as div | eval result=columnB/div | table columnA, ColumnB,result </CODE></PRE> Wed, 11 Mar 2015 00:47:25 GMT ramdaspr 2015-03-11T00:47:25Z https://community.splunk.com/t5/Splunk-Search/How-to-iterate-a-value-in-ColumnA-through-all-values-in-ColumnB/m-p/173481#M49755 <P>Hello folks,</P> <P>I have a stats result with two columns:</P> <P><EM>Column A - only one result in the first line<BR /> Column B - 8 lines of different values</EM></P> <P>I'd like to iterate the value in Column A through all the values in Column B, doing a eval division, that would be returned in a third column.<BR /> For example: columnA.firstline/columnB.firstline, columnA.secondline/columnB.firstline, ...</P> <P>Is it possible?</P> <P>Thanks in advance!</P> Tue, 10 Mar 2015 15:19:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-iterate-a-value-in-ColumnA-through-all-values-in-ColumnB/m-p/173481#M49755 mrncst 2015-03-10T15:19:19Z https://community.splunk.com/t5/Splunk-Search/How-to-iterate-a-value-in-ColumnA-through-all-values-in-ColumnB/m-p/173482#M49756 <P>I am guessing ColumnB is a multivalued field (output of aggregation commands like values/list). Here is what you can try</P> <PRE><CODE>your base search giving single valued field ColumnA and multivalued field ColumnB | eval ColumnB_Orig=ColumnB| mvexpand ColumnB | eval ColumnC=round(ColumnA/ColumnB,2) | rename ColumnB_Orig as ColumnB| table ColumnA, ColumnB, ColumnC </CODE></PRE> Tue, 10 Mar 2015 17:38:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-iterate-a-value-in-ColumnA-through-all-values-in-ColumnB/m-p/173482#M49756 somesoni2 2015-03-10T17:38:06Z https://community.splunk.com/t5/Splunk-Search/How-to-iterate-a-value-in-ColumnA-through-all-values-in-ColumnB/m-p/173483#M49757 <P>If the column isnt multivalues, you can use streamstats to capture what the first value of the column is and use it to calculate the new column.</P> <PRE><CODE>... | streamstats first(columnA) as div | eval result=columnB/div | table columnA, ColumnB,result </CODE></PRE> Wed, 11 Mar 2015 00:47:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-iterate-a-value-in-ColumnA-through-all-values-in-ColumnB/m-p/173483#M49757 ramdaspr 2015-03-11T00:47:25Z