The way I do this in excel is by using the formula "=PRODUCT(C2*C3*C4*C5)"
How can I do that in Splunk?
Ideally, I want to do something like this:
search stuff
| foreach group
[eval crossyield=PRODUCT(yield)]
@rslama
You can achieve this scenario by playing with some awesome SPL commands. Can you please try this?
YOUR_SEARCH | eventstats list(Yield) as crossYield by Group | nomv crossYield | map search="| makeresults | eval s=\"$crossYield$\", s=split(s,\" \"), a=1 | mvexpand s | accum a | eval val_{a}=s | stats values(val_*) as val_* | eval crossYield=round(1,10) | foreach val_* [ eval crossYield=exact(crossYield * '<<FIELD>>') ] | eval Group=\"$Group$\",SubGroup=\"$SubGroup$\",Yield=\"$Yield$\" | table Group SubGroup Yield crossYield "
Sample Search:
| makeresults | eval _raw="Group SubGroup Yield
A A.0 0.9
A A.1 0.99
A A.2 0.75
A A.4 0.8
B B.1 1
B B.2 0.9
B B.11 0.3
C C.5 1
C C.19 0.8" | multikv | table Group SubGroup Yield | eventstats list(Yield) as crossYield by Group | nomv crossYield | map search="| makeresults | eval s=\"$crossYield$\", s=split(s,\" \"), a=1 | mvexpand s | accum a | eval val_{a}=s | stats values(val_*) as val_* | eval crossYield=round(1,10) | foreach val_* [ eval crossYield=exact(crossYield * '<<FIELD>>') ] | eval Group=\"$Group$\",SubGroup=\"$SubGroup$\",Yield=\"$Yield$\" | table Group SubGroup Yield crossYield "
Thanks
@rslama
You can achieve this scenario by playing with some awesome SPL commands. Can you please try this?
YOUR_SEARCH | eventstats list(Yield) as crossYield by Group | nomv crossYield | map search="| makeresults | eval s=\"$crossYield$\", s=split(s,\" \"), a=1 | mvexpand s | accum a | eval val_{a}=s | stats values(val_*) as val_* | eval crossYield=round(1,10) | foreach val_* [ eval crossYield=exact(crossYield * '<<FIELD>>') ] | eval Group=\"$Group$\",SubGroup=\"$SubGroup$\",Yield=\"$Yield$\" | table Group SubGroup Yield crossYield "
Sample Search:
| makeresults | eval _raw="Group SubGroup Yield
A A.0 0.9
A A.1 0.99
A A.2 0.75
A A.4 0.8
B B.1 1
B B.2 0.9
B B.11 0.3
C C.5 1
C C.19 0.8" | multikv | table Group SubGroup Yield | eventstats list(Yield) as crossYield by Group | nomv crossYield | map search="| makeresults | eval s=\"$crossYield$\", s=split(s,\" \"), a=1 | mvexpand s | accum a | eval val_{a}=s | stats values(val_*) as val_* | eval crossYield=round(1,10) | foreach val_* [ eval crossYield=exact(crossYield * '<<FIELD>>') ] | eval Group=\"$Group$\",SubGroup=\"$SubGroup$\",Yield=\"$Yield$\" | table Group SubGroup Yield crossYield "
Thanks
Thank @kamlesh_vaghela
this works perfectly. but how do I change limit=0?
I am only getting 10 results in my statistics table.
NVM, I found the answer. I needed to set maxsearch