Unable to use eval with stats

[freephoneid]

How do I use eval in below query to add hard coded value, say 1000 to the final count?

index=myindex | stats first(id) by uid | fields – uid | stats sum()

I tried using

index=myindex | stats first(id) by uid | fields – uid | stats eval(1000 + sum()) 

but the eval does not work with stats…

Any help is much appreciated!

Thanks!

[kristian_kolb · Accepted solution]

Hmm, not really sure about what you're trying to accomplish, but adding a static value is quite simple. Since I don't really understand your goals, I'll illustrate it with adding 1000 to the http-status value in an access_combined log.

sourcetype=access_combined | eval status=status+1000 | stats values(status) AS new_status by clientip

This results in a table like

clientip      new_status
----------------------
1.2.3.4       1404
              1200
              1503

1.2.3.5       1200
              1302

Hope this helps a little bit at least. Feel free to give more information on what you want to achieve.

UPDATE: would the following search give the same results as what you have right now, i.e. not adding the 1000?

index=myindex | stats first(id) AS temp_id by uid | stats sum(temp_id) 

in that case

index=myindex | stats first(id) AS temp_id by uid | stats sum(temp_id) AS temp_id | eval temp_id = temp_id +1000

should to the trick.

/Kristian

[kristian_kolb]

Hi.. do want to sum up all fields. Or is it just one. Since I don't have your data to play with, I used access_combined logs with clientip and status instead of id and uid.

From what I understand in your query, your first stats command will give you two columns, and then you filter one out with the fields command. Then you just have id left.

See edit of original answer for more info.

[freephoneid]

hi...I want to add hard coded value 1000 to the output of the stats sum()....How can I do this? If index=myindex | stats first(id) by uid | fields – uid | stats sum() gives 500 as output then I want it to be displayed as 1500 as single value...