topic Re: Sum fields in Splunk Search

Sum fields

isachristophe — Sun, 21 Jan 2018 05:50:25 GMT

I would like realize a sum of data like that par exemple :

data = data + val1

But splunk dioesn’t recognize this sum.

Do you know I can do that ?

Re: Sum fields

493669 — Sun, 21 Jan 2018 05:55:48 GMT

Hi @isachristophe,
try to convert string into number by convert command

<base search>| convert num(data) as data |eval data = data + val1

Re: Sum fields

mayurr98 — Sun, 21 Jan 2018 07:34:24 GMT

can you provide entire query in 101010 sample code format?also can you provide some sample input and output you want ??

Re: Sum fields

isachristophe — Sun, 21 Jan 2018 15:02:37 GMT

No it doesn’t work .
Even if you put this instruction :
Convert num (compteur) as compteur | eval compteur = compteur + 1 | table compteur

You have nothing in compteur

Re: Sum fields

493669 — Sun, 21 Jan 2018 15:08:56 GMT

what value is present in compteur?
and have you tried same code...as I can see space in between num and (.
provide entire query in 101010 sample code format.

Re: Sum fields

isachristophe — Sun, 21 Jan 2018 15:48:57 GMT

I would like to put in compteur the precedent value of the iteration, but it seems impossible

Re: Sum fields

ddrillic — Sun, 21 Jan 2018 15:56:41 GMT

If you can try please -

index="<any_index>" 
| eval data="111222" 
| eval val1=666 
| convert num(data) as data 
| eval data = data + val1
| table data

Re: Sum fields

493669 — Sun, 21 Jan 2018 15:57:10 GMT

provide sample input and output you expect

Re: Sum fields

493669 — Sun, 21 Jan 2018 16:00:32 GMT

| makeresults |   eval data="111222" 
 | eval val1=666 
 | convert num(data)     | eval data = data + val1
 | table data

Its working fine...given result as "111888"