How to change the result of my stats count?

[juliop3p]

Hi guys,

I'm a Splunk beginner and I'm having some trouble making a specific query.

I have a health check log, I want to know how many times the user restarts my app. The first health check log is when the user logs in for the first time and the next is the times that the user restarts my app.

This is my current query:

index=myIndex Title=Healthcheck | stats count by Data.Ip

With the result of this query I have the total times the user opened my app, but I want to remove just 1 from the count of each user

current result:

Data.IP	count
4.21.28.39	5
21.224.60.37	3

expected result:

Data.IP	count
4.21.28.39	4
21.224.60.37	2

[richgalloway · Accepted solution]

Use the eval command to do that arithmetic.

index=myIndex Title=Healthcheck 
| stats count by Data.Ip
| eval count = count - 1