Splunk Search

How to apply operator on a specific value in a table?

dyeo
Engager

I'm trying to divide a specific value in a table by 10. What is the best way to do this?

My search:
(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz (Failure_Reason="Unknown user name or bad password.")) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff sourcetype=www action=failure)
| eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName)
| eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E")
| stats dc(output) as count by descrip

I would like to divide only the count value in row B by 10. Is this possible?

Thank you!

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Just add this:

... | eval count=if(descrip="B", count/10, count)

View solution in original post

0 Karma

woodcock
Esteemed Legend

Just add this:

... | eval count=if(descrip="B", count/10, count)
0 Karma

dyeo
Engager

Thanks, that worked!

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...