Calculate and display jump in connections

[MikeElliott]

Hi all,

I have written a search that will list the "average daily connections" originating from a source ip address, as well as listing the "actual daily connections" from a source ip address.

I was wondering how I would write a statement at the end to only return results where the "actual daily connections" is 3 times (3*) the "average daily connections".

For example:

| where "Actual_Daily_Connections" >= 3*("Average_Daily_Connections")

Any assistance would be greatly appreciated 🙂

[MikeElliott · Accepted solution]

I managed to resolve it on my own - I used the below:

|where Actual_Daily_Connections >= (3*Average_Daily_Connections)

I don't think I can mark my own answer, so a mod/admin can close this when seen.

[richgalloway]

Yes, you are allowed to answer your questions and accept the answers. You have to answer the question, however, not reply to it. I've converted your reply to an answer so you can accept it.

[MikeElliott]

@richgalloway - Thanks! 🙂