Splunk Search

Multiply value by 100.

Explorer

I have the following search

index="commercial_performance"  Cat1="Unit Cost Modelled Standard Activity Rate" Value!="within *" $month_token$ $Customer_token$ $SL_token$ | stats avg(Value) AS "Planned" by Cat      
| appendcols [search index="commercial_performance"  Cat1="Unit Cost Actual" Value!="within *" $month_token$ $Customer_token$ $SL_token$ | stats avg(Value) AS "Actual" by Cat]

I want to multiply 'Value' by 100. How do I do this?

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

Try this:

... | eval Value=Value*100 | stats avg(Value) ...

You'll need the eval command in both your main search and in the subsearch.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

SplunkTrust
SplunkTrust

Try this

index="commercial_performance"  Cat1="Unit Cost Modelled Standard Activity Rate" Value!="within *" $month_token$ $Customer_token$ $SL_token$  | eval Value=Value*100 | stats avg(Value) AS "Planned" by Cat      
 | appendcols [search index="commercial_performance"  Cat1="Unit Cost Actual" Value!="within *" $month_token$ $Customer_token$ $SL_token$ | eval Value=Value*100 | stats avg(Value) AS "Actual" by Cat]

OR

index="commercial_performance"  Cat1="Unit Cost Modelled Standard Activity Rate" Value!="within *" $month_token$ $Customer_token$ $SL_token$ | stats avg(Value) AS "Planned" by Cat      
 | appendcols [search index="commercial_performance"  Cat1="Unit Cost Actual" Value!="within *" $month_token$ $Customer_token$ $SL_token$ | stats avg(Value) AS "Actual" by Cat] | eval Planned=Planned*100 | eval Actual=Actual*100
0 Karma