This is my string
.....| eval actionSend=if(action="Send", 1, null) | eval actionRecv=if(action="Receive", 1, null) | eval actionLogon=if(action="Logon", 1, null) | convert timeformat="%m-%d-%Y" ctime(_time) AS date | stats values(date) values(datacenter) count(actionLogon) count(actionSend) count(actionRecv) by user | sort -count(actionLogon) | uniq datacenter
I need to divide the count(actionLogon) by 2
I have tried | eval actionLogon=actionLogon/2 at the end of my string, it doesnt fail, but it also doesnt divide the column/value being displayed in count(actionLogon)
Thanks!
hi,
write this : count(actionLogon) AS Num_actionLogon
and |eval logon= Num_actionLogon/2
and give you something like this:
....| eval actionSend=if(action="Send", 1, null) | eval actionRecv=if(action="Receive", 1, null) | eval actionLogon=if(action="Logon", 1, null) | convert timeformat="%m-%d-%Y" ctime(_time) AS date | stats values(date) values(datacenter) count(actionLogon) AS Num_actionLogon count(actionSend) count(actionRecv) by user | sort -count(actionLogon) | uniq datacenter |eval logon= Num_actionLogon/2
hi,
write this : count(actionLogon) AS Num_actionLogon
and |eval logon= Num_actionLogon/2
and give you something like this:
....| eval actionSend=if(action="Send", 1, null) | eval actionRecv=if(action="Receive", 1, null) | eval actionLogon=if(action="Logon", 1, null) | convert timeformat="%m-%d-%Y" ctime(_time) AS date | stats values(date) values(datacenter) count(actionLogon) AS Num_actionLogon count(actionSend) count(actionRecv) by user | sort -count(actionLogon) | uniq datacenter |eval logon= Num_actionLogon/2
That worked. Thank you!
your welcome, don't forget to vote