https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472586#M132990 <P>Sum of a multivalue field inside a row </P> <P>Hi below is how my processed data look like<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7634i06F3A81C781BA122/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>And the expected output is to have aggregated values of Field A, field B, field C and Total, <BR /> the expected output looks like below :<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7635i1CA47DFE26037046/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 05 Sep 2019 08:03:50 GMT varunCarbyne 2019-09-05T08:03:50Z https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472586#M132990 <P>Sum of a multivalue field inside a row </P> <P>Hi below is how my processed data look like<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7634i06F3A81C781BA122/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>And the expected output is to have aggregated values of Field A, field B, field C and Total, <BR /> the expected output looks like below :<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7635i1CA47DFE26037046/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Thu, 05 Sep 2019 08:03:50 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472586#M132990 varunCarbyne 2019-09-05T08:03:50Z https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472587#M132991 <P>I have tried eventstats(FieldA) by User, But its now working </P> Thu, 05 Sep 2019 08:09:18 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472587#M132991 varunCarbyne 2019-09-05T08:09:18Z https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472588#M132992 <P>@vnravikumar @harishalipaka </P> Thu, 05 Sep 2019 08:15:50 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472588#M132992 varunCarbyne 2019-09-05T08:15:50Z https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472589#M132993 <P>Hi varunCarbyne,<BR /> could you share your search?<BR /> Bye.<BR /> Giuseppe</P> Thu, 05 Sep 2019 08:16:26 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472589#M132993 gcusello 2019-09-05T08:16:26Z https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472590#M132994 <P>@varunCarbyne </P> <P>Try</P> <PRE><CODE>YOUR_SEARCH | stats sum("field A") as "field A", sum("field B") as "field B",sum("field C") as "field C",sum(Total) as Total, Values(IP) as IP by User | table User IP "field A" "field B" "field C" Total </CODE></PRE> Thu, 05 Sep 2019 08:17:59 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472590#M132994 kamlesh_vaghela 2019-09-05T08:17:59Z https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472591#M132995 <P>Come on, @kamlesh_vaghela , if you're going to answer correctly, make it an answer!</P> Thu, 05 Sep 2019 14:54:58 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472591#M132995 DalJeanis 2019-09-05T14:54:58Z https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472592#M132996 <P>Thanks, @DalJeanis <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> <P>Converted to Answer. </P> Tue, 10 Sep 2019 04:53:33 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-a-multivalue-field-inside-a-row/m-p/472592#M132996 kamlesh_vaghela 2019-09-10T04:53:33Z