https://community.splunk.com/t5/Reporting/Summing-multiple-matches-with-rex-command/m-p/549191#M8997 <LI-CODE lang="markup">| makeresults | eval _raw="RandomStuff|LoginCount=5|RandomStuff|LoginCount=3|More RandomStuff|LoginCount=4|YetMoreRandomStuff RandomStuff|LoginCount=6|RandomStuff|LoginCount=7|More RandomStuff|LoginCount=3|YetMoreRandomStuff" | multikv noheader=t | fields _* | rex max_match=0 "LoginCount=(?&lt;logincount&gt;\d+)" | streamstats count as row | eventstats sum(logincount) as logincount by row | fields - row</LI-CODE> Fri, 23 Apr 2021 20:57:19 GMT ITWhisperer 2021-04-23T20:57:19Z https://community.splunk.com/t5/Reporting/Summing-multiple-matches-with-rex-command/m-p/549187#M8995 <P>I have a pattern of text that appears in a log statement multiple times.</P><P>Here is an example:</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">RandomStuff|LoginCount=5|RandomStuff|LoginCount=3|More RandomStuff|LoginCount=4|YetMoreRandomStuff</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>How can I use the rex command to get a sum of all the LoginCount values (which would total 12 in this example)?</P><P>Thanks!</P><P>Jonathan</P> Fri, 23 Apr 2021 20:43:06 GMT https://community.splunk.com/t5/Reporting/Summing-multiple-matches-with-rex-command/m-p/549187#M8995 jbrenner 2021-04-23T20:43:06Z https://community.splunk.com/t5/Reporting/Summing-multiple-matches-with-rex-command/m-p/549189#M8996 <P>I forgot to mention that I don't know how many times LoginCount will appear in any particular log statement. The number of instances will vary.</P> Fri, 23 Apr 2021 20:45:32 GMT https://community.splunk.com/t5/Reporting/Summing-multiple-matches-with-rex-command/m-p/549189#M8996 jbrenner 2021-04-23T20:45:32Z https://community.splunk.com/t5/Reporting/Summing-multiple-matches-with-rex-command/m-p/549191#M8997 <LI-CODE lang="markup">| makeresults | eval _raw="RandomStuff|LoginCount=5|RandomStuff|LoginCount=3|More RandomStuff|LoginCount=4|YetMoreRandomStuff RandomStuff|LoginCount=6|RandomStuff|LoginCount=7|More RandomStuff|LoginCount=3|YetMoreRandomStuff" | multikv noheader=t | fields _* | rex max_match=0 "LoginCount=(?&lt;logincount&gt;\d+)" | streamstats count as row | eventstats sum(logincount) as logincount by row | fields - row</LI-CODE> Fri, 23 Apr 2021 20:57:19 GMT https://community.splunk.com/t5/Reporting/Summing-multiple-matches-with-rex-command/m-p/549191#M8997 ITWhisperer 2021-04-23T20:57:19Z https://community.splunk.com/t5/Reporting/Summing-multiple-matches-with-rex-command/m-p/549867#M9034 <P>Thank you! This is exactly what I needed!</P> Thu, 29 Apr 2021 15:12:04 GMT https://community.splunk.com/t5/Reporting/Summing-multiple-matches-with-rex-command/m-p/549867#M9034 jbrenner 2021-04-29T15:12:04Z