Splunk Search

How to edit my search to divide the sum by a specific number?

Hppjet
Path Finder
ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) by EmployeeLoggedInLastName

I want to divide the sum by a specific number like 3600.

Tags (3)
1 Solution

somesoni2
Revered Legend

You can either do this

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600

OR

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"  
| eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName

View solution in original post

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @Hppjet, if somesoni2 solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

0 Karma

Hppjet
Path Finder

Of course but I won't accept answers while I'm away from work...

0 Karma

somesoni2
Revered Legend

You can either do this

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600

OR

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"  
| eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...