Alternative for eval while using pivot

[sushmitha_mj]

I wanted to accelerate my searches so I am using data models and pivot.

| pivot Accounting Accounting  sum(Input) AS "Input" sum(Output) AS "Output" dc(User_Name) AS "Distinct Count of User_Name" SPLITROW _time AS _time PERIOD hour SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 

I want to do a simple sum(Input)/10000 as "input" (Division by 10000) that's all.
I tried using stats before the sum and also eval, but it does not work on a pivot. How can I do this?

[alacercogitatus · Accepted solution]

I don't currently have a way to test this, but if it behaves like the timechart command, you should be able to do this:

| pivot Accounting Accounting  sum(eval(Input/1000))  AS "Input" sum(Output) AS "Output" dc(User_Name) AS "Distinct Count of User_Name" SPLITROW _time AS _time PERIOD hour SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 0 SHOWOTHER 1 

[emoyoun]

I downvoted this post because i tried the same and it didn't work for me.

[ppablo]

Hi @emoyoun

Please reserve downvoting for answers and suggestions that could potentially be harmful for a Splunk environment, not just because something didn't work for you. as this solution can be useful for other users. Please review how voting etiquette works in the Splunk community and this forum before further engaging in the forum.
https://answers.splunk.com/answers/244111/proper-etiquette-and-timing-for-voting-here-on-ans.html

[emoyoun]

I tried this and it didn't work.
| pivot Statistics HTTP sum(eval(count/3600)) AS "Total Number of Transactions"

I get this error:
Error in 'PivotCell': The object 'HTTP' has no field 'eval(count/3600'.

Any ideas??