Splunk Search

How to apply operator on a specific value in a table?

dyeo
Engager

I'm trying to divide a specific value in a table by 10. What is the best way to do this?

My search:
(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz (Failure_Reason="Unknown user name or bad password.")) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff sourcetype=www action=failure)
| eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName)
| eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E")
| stats dc(output) as count by descrip

I would like to divide only the count value in row B by 10. Is this possible?

Thank you!

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Just add this:

... | eval count=if(descrip="B", count/10, count)

View solution in original post

0 Karma

woodcock
Esteemed Legend

Just add this:

... | eval count=if(descrip="B", count/10, count)
0 Karma

dyeo
Engager

Thanks, that worked!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...