Splunk Search

How to edit my search to divide the sum by a specific number?

Hppjet
Path Finder
ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) by EmployeeLoggedInLastName

I want to divide the sum by a specific number like 3600.

Tags (3)
1 Solution

somesoni2
Revered Legend

You can either do this

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600

OR

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"  
| eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName

View solution in original post

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @Hppjet, if somesoni2 solved your problem, please don't forget to accept an answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

0 Karma

Hppjet
Path Finder

Of course but I won't accept answers while I'm away from work...

0 Karma

somesoni2
Revered Legend

You can either do this

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName | eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600

OR

ShiftName="1" EmployeeLoggedInLastName="*" MachineNumber="*"  
| eval ElapsedMachineSecondsInOrderPath=ElapsedMachineSecondsInOrderPath/3600
| stats sum(ElapsedMachineSecondsInOrderPath) as ElapsedMachineSecondsInOrderPath by EmployeeLoggedInLastName
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...