topic Re: Sum by Name Regex in Splunk Search

Sum by Name Regex

splunk219783 — Fri, 18 Oct 2019 15:43:50 GMT

I've spent awhile messing around with this and can't get anything working. I need to sum a list like this by Storage1 and Storage2 to get a total of each Storage*. This is a much larger list in reality with a dozen or so different Storage#s, and Multiple locations.

I'd imagine i need some type of regex where i can sum by then sum by

Location1-Storage1-1, 500GB
Location1-Storage1-2, 250GB
Location1-Storage1-3, 200GB
Location2-Storage2-1, 100GB
Location2-Storage2-2, 150GB
Location2-Storage2-3, 150GB

Desired Output:

Storage1: 950GB
Storage2: 400GB
Location1: 950GB
Location 2: 400GB

Re: Sum by Name Regex

richgalloway — Fri, 18 Oct 2019 16:03:30 GMT

Try this query.

index=foo | rex "(?<location>[^\-]+?)-(?<storage>[^\-]+)-\d+, (?<size>\d+)" | stats sum(size) as TotalSize by location,storage

Re: Sum by Name Regex

splunk219783 — Fri, 18 Oct 2019 19:18:24 GMT

Thank you! This definitely got me on my way, i've got it working now.