https://community.splunk.com/t5/Splunk-Search/getting-sum-of-a-multivalues-field-for-ach-event/m-p/466984#M131425 <PRE><CODE>index=linux sourcetype=iostat mount="*" | streamstats window=1 sum(total_ops) as total_ops | stats sum(total_ops) as total_ops by mount host </CODE></PRE> Sat, 15 Feb 2020 04:23:09 GMT to4kawa 2020-02-15T04:23:09Z https://community.splunk.com/t5/Splunk-Search/getting-sum-of-a-multivalues-field-for-ach-event/m-p/466982#M131423 <P>Hi,</P> <P>I have a query like below.</P> <P>index=linux sourcetype=iostat mount="*" <BR /> which will list total_ops for each mount of a host in multiple events.</P> <P>i need to get sum of total_ops of each host of all mounts from latest event.</P> <P>Please help</P> Fri, 14 Feb 2020 13:51:10 GMT https://community.splunk.com/t5/Splunk-Search/getting-sum-of-a-multivalues-field-for-ach-event/m-p/466982#M131423 vijaya5 2020-02-14T13:51:10Z https://community.splunk.com/t5/Splunk-Search/getting-sum-of-a-multivalues-field-for-ach-event/m-p/466983#M131424 <P>Try this:</P> <PRE><CODE>index=linux sourcetype=iostat mount="*" | mvexpand total_ops </CODE></PRE> <P>That will break the multivalue field into separate events. Then you can add your stats, etc.<BR /> Worth noting, you can only use mvexpand on a single field.</P> Fri, 14 Feb 2020 15:41:40 GMT https://community.splunk.com/t5/Splunk-Search/getting-sum-of-a-multivalues-field-for-ach-event/m-p/466983#M131424 codebuilder 2020-02-14T15:41:40Z https://community.splunk.com/t5/Splunk-Search/getting-sum-of-a-multivalues-field-for-ach-event/m-p/466984#M131425 <PRE><CODE>index=linux sourcetype=iostat mount="*" | streamstats window=1 sum(total_ops) as total_ops | stats sum(total_ops) as total_ops by mount host </CODE></PRE> Sat, 15 Feb 2020 04:23:09 GMT https://community.splunk.com/t5/Splunk-Search/getting-sum-of-a-multivalues-field-for-ach-event/m-p/466984#M131425 to4kawa 2020-02-15T04:23:09Z