Splunk Search

## How to multiply column values?

Path Finder

The way I do this in excel is by using the formula `"=PRODUCT(C2*C3*C4*C5)"`
How can I do that in Splunk?

Ideally, I want to do something like this:
search stuff

``````| foreach group
[eval crossyield=PRODUCT(yield)]
``````

Tags (3)
1 Solution
SplunkTrust

@rslama

You can achieve this scenario by playing with some awesome SPL commands. Can you please try this?

``````YOUR_SEARCH | eventstats list(Yield) as crossYield by Group | nomv crossYield | map search="| makeresults | eval s=\"\$crossYield\$\", s=split(s,\" \"), a=1 | mvexpand s | accum a | eval val_{a}=s | stats values(val_*) as val_* | eval crossYield=round(1,10) | foreach val_* [ eval crossYield=exact(crossYield * '<<FIELD>>') ] | eval Group=\"\$Group\$\",SubGroup=\"\$SubGroup\$\",Yield=\"\$Yield\$\" | table Group SubGroup Yield crossYield "
``````

Sample Search:

``````| makeresults | eval _raw="Group    SubGroup    Yield
A   A.0 0.9
A   A.1 0.99
A   A.2 0.75
A   A.4 0.8
B   B.1 1
B   B.2 0.9
B   B.11    0.3
C   C.5 1
C   C.19    0.8" | multikv | table Group SubGroup Yield | eventstats list(Yield) as crossYield by Group | nomv crossYield | map search="| makeresults | eval s=\"\$crossYield\$\", s=split(s,\" \"), a=1 | mvexpand s | accum a | eval val_{a}=s | stats values(val_*) as val_* | eval crossYield=round(1,10) | foreach val_* [ eval crossYield=exact(crossYield * '<<FIELD>>') ] | eval Group=\"\$Group\$\",SubGroup=\"\$SubGroup\$\",Yield=\"\$Yield\$\" | table Group SubGroup Yield crossYield "
``````

Thanks

SplunkTrust

@rslama

You can achieve this scenario by playing with some awesome SPL commands. Can you please try this?

``````YOUR_SEARCH | eventstats list(Yield) as crossYield by Group | nomv crossYield | map search="| makeresults | eval s=\"\$crossYield\$\", s=split(s,\" \"), a=1 | mvexpand s | accum a | eval val_{a}=s | stats values(val_*) as val_* | eval crossYield=round(1,10) | foreach val_* [ eval crossYield=exact(crossYield * '<<FIELD>>') ] | eval Group=\"\$Group\$\",SubGroup=\"\$SubGroup\$\",Yield=\"\$Yield\$\" | table Group SubGroup Yield crossYield "
``````

Sample Search:

``````| makeresults | eval _raw="Group    SubGroup    Yield
A   A.0 0.9
A   A.1 0.99
A   A.2 0.75
A   A.4 0.8
B   B.1 1
B   B.2 0.9
B   B.11    0.3
C   C.5 1
C   C.19    0.8" | multikv | table Group SubGroup Yield | eventstats list(Yield) as crossYield by Group | nomv crossYield | map search="| makeresults | eval s=\"\$crossYield\$\", s=split(s,\" \"), a=1 | mvexpand s | accum a | eval val_{a}=s | stats values(val_*) as val_* | eval crossYield=round(1,10) | foreach val_* [ eval crossYield=exact(crossYield * '<<FIELD>>') ] | eval Group=\"\$Group\$\",SubGroup=\"\$SubGroup\$\",Yield=\"\$Yield\$\" | table Group SubGroup Yield crossYield "
``````

Thanks

Path Finder

Thank @kamlesh_vaghela
this works perfectly. but how do I change limit=0?
I am only getting 10 results in my statistics table.

Path Finder

NVM, I found the answer. I needed to set maxsearch

The Latest From the Splunk Community!