How to do a simple calculation based on two form values?

[apnetmedic]

I've got two tokens in an input form, let's call them token1 and token2. They are each used to construct some searches, and that's all fine and good.

I'd also like to do a simple calculation based on these, like: someResult = token1 x token2 x someConstant, and display that in a single value panel.

I just can't figure out how to do that without an actual search involved. It's got to be easy... right?

[jlin]

I believe the best way would be to use calculated fields - http://docs.splunk.com/Documentation/Splunk/6.2.0/Knowledge/definecalcfields

In props.conf, you could set up a calculated field such as:

[<stanza>]

EVAL-<field_name> = <eval statement>

which in your case:

[<your_stanza>]

EVAL-someResult = token1 * token2 * <someConstant>

[somesoni2]

You can create dummy results using gentimes without hitting any actual index/sourcetype.

e.g.

|gentimes start=-1 |  eval someResult = $token1$ * $token2$ * someConstant | table someResult

[apnetmedic]

Even easier is probably something like:
| stats count(_raw) | eval someResult = token1 * token2 * someConstant | table someResult

That spends minimal time on the search, which returns 0 events, then stats count() returns 1 row, and my eval then produces something.

EDIT: took out an initial empty search. @somesoni2 led me there with the | gentimes | idea. That works too, really anything that will generate one row of data to throw away.

[Raghav2384]

Can be achieved using post processing searches.
Make the selections mentioned in the search template, please refer ui examples app.

Once you have the parent search, insert a separate chart panel to do some thing like table someResult.
someResult would be (token1*token2*constant). There might be other ways to do it.