How do I use eval in below query to add hard coded value, say 1000 to the final count?
index=myindex | stats first(id) by uid | fields – uid | stats sum()
I tried using
index=myindex | stats first(id) by uid | fields – uid | stats eval(1000 + sum())
but the eval does not work with stats…
Any help is much appreciated!
Thanks!
Hmm, not really sure about what you're trying to accomplish, but adding a static value is quite simple. Since I don't really understand your goals, I'll illustrate it with adding 1000 to the http-status value in an access_combined log.
sourcetype=access_combined | eval status=status+1000 | stats values(status) AS new_status by clientip
This results in a table like
clientip new_status
----------------------
1.2.3.4 1404
1200
1503
1.2.3.5 1200
1302
Hope this helps a little bit at least. Feel free to give more information on what you want to achieve.
UPDATE: would the following search give the same results as what you have right now, i.e. not adding the 1000?
index=myindex | stats first(id) AS temp_id by uid | stats sum(temp_id)
in that case
index=myindex | stats first(id) AS temp_id by uid | stats sum(temp_id) AS temp_id | eval temp_id = temp_id +1000
should to the trick.
/Kristian
Hmm, not really sure about what you're trying to accomplish, but adding a static value is quite simple. Since I don't really understand your goals, I'll illustrate it with adding 1000 to the http-status value in an access_combined log.
sourcetype=access_combined | eval status=status+1000 | stats values(status) AS new_status by clientip
This results in a table like
clientip new_status
----------------------
1.2.3.4 1404
1200
1503
1.2.3.5 1200
1302
Hope this helps a little bit at least. Feel free to give more information on what you want to achieve.
UPDATE: would the following search give the same results as what you have right now, i.e. not adding the 1000?
index=myindex | stats first(id) AS temp_id by uid | stats sum(temp_id)
in that case
index=myindex | stats first(id) AS temp_id by uid | stats sum(temp_id) AS temp_id | eval temp_id = temp_id +1000
should to the trick.
/Kristian
Hi.. do want to sum up all fields. Or is it just one. Since I don't have your data to play with, I used access_combined logs with clientip and status instead of id and uid.
From what I understand in your query, your first stats command will give you two columns, and then you filter one out with the fields command. Then you just have id left.
See edit of original answer for more info.
hi...I want to add hard coded value 1000 to the output of the stats sum()....How can I do this? If index=myindex | stats first(id) by uid | fields – uid | stats sum() gives 500 as output then I want it to be displayed as 1500 as single value...