I have Below Splunk query to get some data from my logs
index=myindex sourcetype=mysourcetype "search string"
| stats sum(TotalRecords) As "Total Records", sum(TotalTime_Taken) As "Total Time Taken" by Content
Below is the result of the above query
Content_Type Total Records Total Time Taken
========== ============= ===========
Documents 13 25
Blogs 25 120
Events 2 5
I want another column in my result Average_time_taken
Average_time_taken = Total Time Taken / Total Records
The result should be as below
Content_Type Total Records Total Time Taken Average_time_taken
========== ============= =========== ====================
Documents 13 25 1.9230
Blogs 25 120 4.8
Events 2 5 2.5
You can just do an eval to create the new field. The only trick is that the field names within the eval statement will need to be in either single quotes or dollar signs to indicate to Splunk that you're referencing fields
| eval Average_time_taken='Total Time Taken'/'Total Records'
it doesn't work for me, I need to use data that I got from stats result, and based on that result I need Average_time_taken.
I'm sorry I should have been more clear. Add the eval statement I provided to the search you used that generated the results.
Given that your results have the fields 'Total Time Taken' and 'Total Records', it will work.
index=myindex sourcetype=mysourcetype "search string"
| stats sum(TotalRecords) As T, sum(TotalTime_Taken) As TT by Content
| eval Average_time_taken= TT / T
| rename T as "Total Records" , TT as "Total Time Taken", Content as Content_Type
| table Content_Type "Total Records" "Total Time Taken" Average_time_taken
Have you try @acfecondo75 recommend like this?