sum specific field value

ips_mandar — Fri, 02 Aug 2019 11:17:38 GMT

I have below events-

value=1
value=3
value=5
value=0
value=4
value=5
value=6
value=0
value=1

Here I want to pick last value before value=0 and at end value if there is no zero value at end like in above case I want value=5 and value=6 and value=1
and add these value to get result as value=12
Kindly guide me to achieve this.
In script it can be done by storing variable and at end adding all. How this can be done in splunk.
Thanks.

Re: sum specific field value

bangalorep — Fri, 02 Aug 2019 12:30:30 GMT

You can try this,

| makeresults 
| eval value="1,3,5,0,4,5,6,0,1" 
| makemv delim="," value 
| mvexpand value 
| fields - _time 
| streamstats current=f window=1 last(value) as break 
| append 
   [| makeresults 
   | eval value="1,3,5,0,4,5,6,0,1" 
   | makemv delim="," value 
   | mvexpand value 
   | fields - _time 
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum

In your case, it will be

`your query`
|  streamstats current=f window=1 last(value) as break 
| append 
   [| `your query`
   | stats last(value) as final] 
| fillnull value=0 
| search value=0 
| eval sum=break+final 
| stats sum(sum) as sum

topic sum specific field value in Splunk Search

sum specific field value

Re: sum specific field value