This is my string
.....| eval actionSend=if(action="Send", 1, null) | eval actionRecv=if(action="Receive", 1, null) | eval actionLogon=if(action="Logon", 1, null) | convert timeformat="%m-%d-%Y" ctime(_time) AS date | stats values(date) values(datacenter) count(actionLogon) count(actionSend) count(actionRecv) by user | sort -count(actionLogon) | uniq datacenter
I need to divide the count(actionLogon) by 2
I have tried | eval actionLogon=actionLogon/2 at the end of my string, it doesnt fail, but it also doesnt divide the column/value being displayed in count(actionLogon)
Thanks!
... View more