Archive

Multiple stats counts in string, need to divide one count by 2

tbrown110
New Member

This is my string

.....| eval actionSend=if(action="Send", 1, null) | eval actionRecv=if(action="Receive", 1, null) | eval actionLogon=if(action="Logon", 1, null) | convert timeformat="%m-%d-%Y" ctime(_time) AS date | stats values(date) values(datacenter) count(actionLogon) count(actionSend) count(actionRecv) by user | sort -count(actionLogon) | uniq datacenter

I need to divide the count(actionLogon) by 2

I have tried | eval actionLogon=actionLogon/2 at the end of my string, it doesnt fail, but it also doesnt divide the column/value being displayed in count(actionLogon)

Thanks!

Tags (1)
0 Karma
1 Solution

gyslainlatsa
Motivator

hi,

write this : count(actionLogon) AS Num_actionLogon and |eval logon= Num_actionLogon/2

and give you something like this:

....| eval actionSend=if(action="Send", 1, null) | eval actionRecv=if(action="Receive", 1, null) | eval actionLogon=if(action="Logon", 1, null) | convert timeformat="%m-%d-%Y" ctime(_time) AS date | stats values(date) values(datacenter) count(actionLogon) AS Num_actionLogon count(actionSend) count(actionRecv) by user | sort -count(actionLogon) | uniq datacenter |eval logon= Num_actionLogon/2

View solution in original post

0 Karma

gyslainlatsa
Motivator

hi,

write this : count(actionLogon) AS Num_actionLogon and |eval logon= Num_actionLogon/2

and give you something like this:

....| eval actionSend=if(action="Send", 1, null) | eval actionRecv=if(action="Receive", 1, null) | eval actionLogon=if(action="Logon", 1, null) | convert timeformat="%m-%d-%Y" ctime(_time) AS date | stats values(date) values(datacenter) count(actionLogon) AS Num_actionLogon count(actionSend) count(actionRecv) by user | sort -count(actionLogon) | uniq datacenter |eval logon= Num_actionLogon/2

View solution in original post

0 Karma

tbrown110
New Member

That worked. Thank you!

0 Karma

gyslainlatsa
Motivator

your welcome, don't forget to vote

0 Karma