1

I am doing a query such that it will take the total count of the a value and then multiply it by some constant. For example :

source="test.csv"  sourcetype="csv" | stats count(adId)

I want to multiply the result returned by the count by 0.5. Suppose if the output by stats count is 124 I want to multiply it by 0.5 and report the output.

user4157124
  • 2,809
  • 13
  • 27
  • 42
Atif Imam
  • 49
  • 1
  • 9

1 Answers1

3

Use eval. First have stats put its result in a better-named field. I also use exact for better precision and round to control the number of decimal places.

source="test.csv"  sourcetype="csv" 
| stats count(adId) as interim 
| eval output = round(exact(interim * 0.5), 3)

You could do it without an interim field, if you wish.

source="test.csv"  sourcetype="csv" 
| stats count(adId) as output
| eval output = round(exact(output * 0.5), 3)
RichG
  • 9,063
  • 2
  • 18
  • 29