I'm pretty new at this so I apologize if the question seems stupid. I have a printer that sends syslogs to Splunk, and whenever the printer processes a job, it sends 2 identical items to Splunk. It's simple enough to get the total count, but dividing it in half is driving me crazy. source = "hp printing" | chart count by host Because of how the printer sends its logs, whatever the above outputs is double the actual number of print jobs the device has processed. I've tried so many combinations and just can't seem to figure it out. source="hp printing" "printing" | chart eval(count/2) by host Above returns "Error in 'chart' command: The eval expression has no fields: 'count/2'." source="hp printing" "printing" | eval print_jobs = count/2 | chart eval(print_jobs) by host Above returns "Error in 'chart command: The eval expression has no fields: 'print_jobs'." I feel like this should be a simple task but just can't seem to nail it down.
... View more
