Splunk Search

How to apply operator on a specific value in a table?

dyeo
Engager

I'm trying to divide a specific value in a table by 10. What is the best way to do this?

My search:
(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz (Failure_Reason="Unknown user name or bad password.")) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff sourcetype=www action=failure)
| eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName)
| eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E")
| stats dc(output) as count by descrip

I would like to divide only the count value in row B by 10. Is this possible?

Thank you!

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Just add this:

... | eval count=if(descrip="B", count/10, count)

View solution in original post

0 Karma

woodcock
Esteemed Legend

Just add this:

... | eval count=if(descrip="B", count/10, count)

View solution in original post

0 Karma

dyeo
Engager

Thanks, that worked!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!