Splunk Search

How to edit my search to divide the sum by a specific number?

Hppjet
Path Finder
ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) by EmployeeLoggedInLastName

I want to divide the sum by a specific number like 3600.

Tags (3)
1 Solution

somesoni2
Revered Legend

You can either do this

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600

OR

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"  
| eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName

View solution in original post

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @Hppjet, if somesoni2 solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

0 Karma

Hppjet
Path Finder

Of course but I won't accept answers while I'm away from work...

0 Karma

somesoni2
Revered Legend

You can either do this

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600

OR

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"  
| eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...