Splunk Search

Multiply value by 100.

deanamite91
Explorer

I have the following search

index="commercial_performance"  Cat1="Unit Cost Modelled Standard Activity Rate" Value!="within *" $month_token$ $Customer_token$ $SL_token$ | stats avg(Value) AS "Planned" by Cat      
| appendcols [search index="commercial_performance"  Cat1="Unit Cost Actual" Value!="within *" $month_token$ $Customer_token$ $SL_token$ | stats avg(Value) AS "Actual" by Cat]

I want to multiply 'Value' by 100. How do I do this?

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this:

... | eval Value=Value*100 | stats avg(Value) ...

You'll need the eval command in both your main search and in the subsearch.

---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
Revered Legend

Try this

index="commercial_performance"  Cat1="Unit Cost Modelled Standard Activity Rate" Value!="within *" $month_token$ $Customer_token$ $SL_token$  | eval Value=Value*100 | stats avg(Value) AS "Planned" by Cat      
 | appendcols [search index="commercial_performance"  Cat1="Unit Cost Actual" Value!="within *" $month_token$ $Customer_token$ $SL_token$ | eval Value=Value*100 | stats avg(Value) AS "Actual" by Cat]

OR

index="commercial_performance"  Cat1="Unit Cost Modelled Standard Activity Rate" Value!="within *" $month_token$ $Customer_token$ $SL_token$ | stats avg(Value) AS "Planned" by Cat      
 | appendcols [search index="commercial_performance"  Cat1="Unit Cost Actual" Value!="within *" $month_token$ $Customer_token$ $SL_token$ | stats avg(Value) AS "Actual" by Cat] | eval Planned=Planned*100 | eval Actual=Actual*100
0 Karma
Get Updates on the Splunk Community!

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...