Splunk Search

How to edit my search to divide the sum by a specific number?

Hppjet
Path Finder
ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) by EmployeeLoggedInLastName

I want to divide the sum by a specific number like 3600.

Tags (3)
1 Solution

somesoni2
Revered Legend

You can either do this

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600

OR

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"  
| eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName

View solution in original post

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @Hppjet, if somesoni2 solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

0 Karma

Hppjet
Path Finder

Of course but I won't accept answers while I'm away from work...

0 Karma

somesoni2
Revered Legend

You can either do this

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600

OR

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"  
| eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName
Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...