Security

Need help with search result multiplied

Rapidz
Explorer

I have a search done on splunk and I need to take the output I receive and multiply it by 2. 

 

My search query is: 

index=app1 AND service=app AND logLevel=INFO AND environment=staging "message.eventAction"=COMPLETE_CREATE | stats dc(message.userId)

Upon using this search, I receive a distinct count of 8, but I want that number to multiply by 2. I cannot seem to figure out how to do this after reading other similar searches. I hope someone can help, it seems like it should not be this difficult for a simple multiplication. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval twice='dc(message.userId)' * 2
0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...