Splunk Search

How to edit my search to divide the sum by a specific number?

Hppjet
Path Finder
ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) by EmployeeLoggedInLastName

I want to divide the sum by a specific number like 3600.

Tags (3)
1 Solution

somesoni2
Revered Legend

You can either do this

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600

OR

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"  
| eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName

View solution in original post

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @Hppjet, if somesoni2 solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

0 Karma

Hppjet
Path Finder

Of course but I won't accept answers while I'm away from work...

0 Karma

somesoni2
Revered Legend

You can either do this

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600

OR

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"  
| eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...