topic Re: Adding Integers/numerical data in 2 multivalue fields to a new field in Splunk Search

Adding Integers/numerical data in 2 multivalue fields to a new field

jaysonpryde — Tue, 27 Jul 2021 03:27:00 GMT

Hi All,

I think the subject of my questions says it all... I wanted to add numerical data from 2 multivalue fields, and save it to a new field.

Field1	Field2	Field3
4	8	12
8	9	17
3	2	5

I know mvappend is not the one to be used here, but I already tried:

| eval field3=mvappend(field1,field2)

Any ideas are greatly appreciated?

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

kamlesh_vaghela — Tue, 27 Jul 2021 04:41:50 GMT

@jaysonpryde

Are you looking for this?

My Sample Search :

Thanks
KV
▄︻̷̿┻̿═━一 ?

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

jaysonpryde — Tue, 27 Jul 2021 04:53:59 GMT

Hi @kamlesh_vaghela , thanks a lot for your feedback.

However, your proposed solution is actually getting the sum of Field1 and Field2.

I am not up to that. As mentioned, I want each row/entry of the the multivalue fields 1 & 2, to be added, and saved on fied 3... Again, what I require is a per entry operation.

Again, thanks a lot for your reply.

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

kamlesh_vaghela — Tue, 27 Jul 2021 05:09:50 GMT

@jaysonpryde

As you said multivalued ( single field with multiple values) field so I though field1 and field2 is multivalued.

As per your provided example in question, did you tried simply addition?

| eval field3=field1 + field2

😕

Or I think I'm still not clear about your expectations.

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

jaysonpryde — Tue, 27 Jul 2021 05:14:03 GMT

Hmm... the solution you provided is not working for me. I always get empty results in field3

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

kamlesh_vaghela — Tue, 27 Jul 2021 05:16:11 GMT

Try this

| eval Field3=tonumber(Field1) + tonumber(Field2)

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

jaysonpryde — Tue, 27 Jul 2021 05:55:40 GMT

still not working... I think you can't just simply add multivalue fields directly.

But still, thanks a lot for your comments. greatly appreciate it

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

kamlesh_vaghela — Tue, 27 Jul 2021 05:57:08 GMT

@jaysonpryde

Can you please share sample OP from this ?

YOUR_SEARCH | head 3 | table Field1 Field2

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

jaysonpryde — Tue, 27 Jul 2021 06:13:32 GMT

example field1 and field2

Like what I placed in my initial post, it's just 2 multivalue fields.

I got the 2 multivalue fields from this search:

| stats list(field1) as field1, list(field2) as field2 by group_name

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

kamlesh_vaghela — Tue, 27 Jul 2021 06:22:51 GMT

@jaysonpryde

Is is possible to add before stats? like

YOUR_SEARCH | eval field3 = field1 + field2 | stats list(field1) as field1, list(field2) as field2,list(field3) as field3 by group_name

| makeresults | eval _raw="field1,field2,group_name 4,8,A 8,9,A 3,2,A" | multikv forceheader=1 | rename comment as "Upto Now is sample data only" | eval field3 = field1 + field2 | stats list(field1) as field1, list(field2) as field2,list(field3) as field3 by group_name

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

ITWhisperer — Tue, 27 Jul 2021 06:24:14 GMT

| eval field3=mvzip(field1,field2,"!") | eval field3=mvmap(field3,tonumber(mvindex(split(field3,"!"),0))+tonumber(mvindex(split(field3,"!"),1)))

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

jaysonpryde — Tue, 27 Jul 2021 06:38:51 GMT

not possible since field1 and field2 are results from operations / evaluations.

I just simplified it on my original post.

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

kamlesh_vaghela — Tue, 27 Jul 2021 06:45:48 GMT

@jaysonpryde

Then I think this will help you.

My Sample Search :

Re: Adding Integers/numerical data in 2 multivalue fields to a new field

jaysonpryde — Wed, 28 Jul 2021 06:10:53 GMT

You're indeed a legend @ITWhisperer . Thank you very much!