Splunk Search

## Math function on stats count

Loves-to-Learn Lots

I would like to do some math operation of retrieved count of each values.

Eg: 318*5.5 + 418*2.5 + 54*5 + 83*2 and get the total from the resulted output(SS attached)

Query used:-

index=omi_qa host=DEFRNC* sourcetype=all_events_custom_attributes SEVERITY IN (CRITICAL,MAJOR,MINOR) OR (SEVERITY=WARNING AND APPLICATION=NNMi) | eval {idx} = elt
| stats latest(CLIP) as CLIP, values(UMN) as UMN by ID | lookup clipUMNs.csv UMN OUTPUTNEW Solution
| search CLIP != "NULL" AND CLIP != "TRUE"
| where Solution = "Escalation"

Tags (2)
SplunkTrust

Perhaps this will help.

``````index=omi_qa host=DEFRNC* sourcetype=all_events_custom_attributes SEVERITY IN (CRITICAL,MAJOR,MINOR) OR (SEVERITY=WARNING AND APPLICATION=NNMi) | eval {idx} = elt
| stats latest(CLIP) as CLIP, values(UMN) as UMN cout as Count by ID | lookup clipUMNs.csv UMN OUTPUTNEW Solution FTE
| search CLIP != "NULL" AND CLIP != "TRUE"
| where Solution = "Escalation"
| eval Product = Count * FTE
| addcoltotals labelfield= ID label="Grand Total" Product
``````
---
If this reply helps you, an upvote would be appreciated.
Loves-to-Learn Lots

It comes from the lookup file. Field name is FTE

SplunkTrust

Where do the multipliers (5.5. 2.5, 5, 2) come from?

---
If this reply helps you, an upvote would be appreciated.
.conf21 CFS Extended through 5/20!

### Don't miss your chance to share your Splunk wisdom in-person or virtually at .conf21!Call for Speakers hasbeen extended throughThursday, 5/20! Submit Now! >

Get Updates on the Splunk Community!