https://community.splunk.com/t5/Getting-Data-In/how-to-sum-numbers-with-space-in-them/m-p/27155#M4513 <P>I have a field called size that takes the form:<BR /> 1 2 3 4 </P> <P>I want to find someway to evaluate size so that is sums all the numbers.<BR /> for example, eval totalsize = <SOME kind="" of="" sum="" function="">(size) would evaluate to 10.</SOME></P> <P>basically my field size is a collection of sizes, and i want to sum it up for the total size.<BR /> stats sum is not an option, since it sums it will sum everything over every single event.I need it to sum one event at a time.</P> <P>to be very specific, here is a picture of what i am going for:<BR /> <A href="http://tinypic.com/r/2pru4h0/6">http://tinypic.com/r/2pru4h0/6</A></P> <P>how do i get totalsize?</P> <P>thanks a bunch</P> <P>EDIT:<BR /> ehh<BR /> i tried something like that<BR /> unfortunately my host fields arent unique<BR /> What im doing is getting file sizes from hosts at different times.<BR /> So for example, host1 could have a different number of files at each event, and i only want to get the sum at each particular event</P> <P>Is there any other way?</P> Thu, 08 Nov 2012 03:33:19 GMT halperkins 2012-11-08T03:33:19Z https://community.splunk.com/t5/Getting-Data-In/how-to-sum-numbers-with-space-in-them/m-p/27155#M4513 <P>I have a field called size that takes the form:<BR /> 1 2 3 4 </P> <P>I want to find someway to evaluate size so that is sums all the numbers.<BR /> for example, eval totalsize = <SOME kind="" of="" sum="" function="">(size) would evaluate to 10.</SOME></P> <P>basically my field size is a collection of sizes, and i want to sum it up for the total size.<BR /> stats sum is not an option, since it sums it will sum everything over every single event.I need it to sum one event at a time.</P> <P>to be very specific, here is a picture of what i am going for:<BR /> <A href="http://tinypic.com/r/2pru4h0/6">http://tinypic.com/r/2pru4h0/6</A></P> <P>how do i get totalsize?</P> <P>thanks a bunch</P> <P>EDIT:<BR /> ehh<BR /> i tried something like that<BR /> unfortunately my host fields arent unique<BR /> What im doing is getting file sizes from hosts at different times.<BR /> So for example, host1 could have a different number of files at each event, and i only want to get the sum at each particular event</P> <P>Is there any other way?</P> Thu, 08 Nov 2012 03:33:19 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-sum-numbers-with-space-in-them/m-p/27155#M4513 halperkins 2012-11-08T03:33:19Z https://community.splunk.com/t5/Getting-Data-In/how-to-sum-numbers-with-space-in-them/m-p/27156#M4514 <P>This solution assumes that the numbers are separated by a single space, and that the host field is unique:</P> <PRE><CODE>yoursearchhere | eval newNums=split(size," ") | mvexpand newNums | stats sum(newNums) as TotalSize by host </CODE></PRE> Thu, 08 Nov 2012 07:34:50 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-sum-numbers-with-space-in-them/m-p/27156#M4514 lguinn2 2012-11-08T07:34:50Z