Search code examples
splunksplunk-query

How do I multiply a column with different values element wise in splunk

I am new to splunk.
I have aggregated a column using 'by' statement now i want to multiply each element in the column with different elements element wise, say first element with 0.05 and rest all with 0.07.
Please help
enter image description here

Solution

  • Adding the following to your query will generate a new column, called count, which increments by one each for each result. Then you know which is the first element, and can multiply if by 0.05, and then multiply all other results by 0.07

    | streamstats count
| eval count(adCategory) = case(count=1,'count(adCategory)'*0.05, 
  1==1, 'count(adCategory)'*0.07)