Apply different calculation count/sum depending on value/index

[martinmasif]

I have a "cost" for two different indexes that I want to calculate in one and the same SPL. As the "price" is different depending on index, I can't just use a "by" clause in my count/sum as I don't know how to apply the separate costs in that way.

Let's say...

idxCheap costs $10 per event.

idxExpensive costs $20 per event.

I've written this SPL that works, although the "cost" data ends up in a unique column for each index. The count is still in the same column.

index=idxCheap OR index=idxExpensive
| stats count by index
| eval idxCheapCost = case(index="idxCheap", count*10)
| eval idxExpensiveCost = case(index="idxExpensive", count*20)

 The results looks like this:

count idxCheapCost idxExpensiveCost index

44892	448920		idxCheap
155		3100	idxExpensive

Any pointers on how to most efficiently and dynamically achieve this?

[richgalloway · Accepted solution]

You're close.  Combine the case functions to produce a single expense field.

index=idxCheap OR index=idxExpensive
| stats count by index
| eval idxCost = case(index="idxCheap", count*10, index="idxExpensive", count*20)

[martinmasif]

Haha why did I even split it up on two rows?!

Thanks!