I'm trying to divide a specific value in a table by 10. What is the best way to do this?
My search:
(index=Wineventlog sourcetype="WinEventLog:security" EventCode=4740 OR (action=failure EventCode=4625 host=eee OR host=xyz (Failure_Reason="Unknown user name or bad password.")) OR (host=asd (EventCode=516 OR EventCode=411) NOT clientIP=10.10.10.10) NOT user="-") OR (index=fff sourcetype=www action=failure)
| eval output=coalesce(userMsg, lockoutUser, user, sAMAccountName)
| eval descrip=case(EventCode=4625, "A", EventCode=4740, "B", EventCode=411, "C", EventCode=516, D", EventCode="AVEN-FAIL", "E")
| stats dc(output) as count by descrip
I would like to divide only the count value in row B by 10. Is this possible?
Thank you!
Just add this:
... | eval count=if(descrip="B", count/10, count)
Thanks, that worked!