https://community.splunk.com/t5/Splunk-Search/Summing-the-row/m-p/126354#M184339 <P>The same but with both fields in the by:<BR /> ...| eventstats sum(ColumnB) as Total by Site, ConfigID | ...</P> Mon, 27 Jan 2014 10:46:10 GMT gfuente 2014-01-27T10:46:10Z https://community.splunk.com/t5/Splunk-Search/Summing-the-row/m-p/126351#M184336 <P>Colum A Column B<BR /> 1 1<BR /> 2 2<BR /> 2 3<BR /> 2 4 <BR /> 5 5</P> <P>I wanted to sum columnB but on condition. Below is the example</P> <P>(Column A) - 1 (Sum of Column B) 1<BR /> (Column A) - 2 (Sum of Column B) 2 + 3 + 4 = 9</P> Mon, 27 Jan 2014 08:41:26 GMT https://community.splunk.com/t5/Splunk-Search/Summing-the-row/m-p/126351#M184336 vinay_ks04 2014-01-27T08:41:26Z https://community.splunk.com/t5/Splunk-Search/Summing-the-row/m-p/126352#M184337 <P>Hello</P> <P>I think you can use eventstats like:</P> <PRE><CODE>...| eventstats sum(ColumnB) as Total by ColumnA | ... </CODE></PRE> <P>Try it and let me know</P> <P>Regards</P> Mon, 27 Jan 2014 09:15:03 GMT https://community.splunk.com/t5/Splunk-Search/Summing-the-row/m-p/126352#M184337 gfuente 2014-01-27T09:15:03Z https://community.splunk.com/t5/Splunk-Search/Summing-the-row/m-p/126353#M184338 <P>Hi, </P> <P>I have used for my another column.</P> <P>there are three columns</P> <P>Site ConfigID TaskCount<BR /> BAN 1 1<BR /> 2 2<BR /> 3 4<BR /> 5 5<BR /> MYS 1 1<BR /> 1 2<BR /> 3 4<BR /> 4 5<BR /> 4 6</P> <P>I have used your menthod for consolidating with site wise.<BR /> Kindly let me know for summing of taskcounts of same configids.</P> Mon, 27 Jan 2014 10:30:04 GMT https://community.splunk.com/t5/Splunk-Search/Summing-the-row/m-p/126353#M184338 vinay_ks04 2014-01-27T10:30:04Z https://community.splunk.com/t5/Splunk-Search/Summing-the-row/m-p/126354#M184339 <P>The same but with both fields in the by:<BR /> ...| eventstats sum(ColumnB) as Total by Site, ConfigID | ...</P> Mon, 27 Jan 2014 10:46:10 GMT https://community.splunk.com/t5/Splunk-Search/Summing-the-row/m-p/126354#M184339 gfuente 2014-01-27T10:46:10Z