topic Re: How to add a column that sums values while keeping the values column in Splunk Search

topic Re: How to add a column that sums values while keeping the values column in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-add-a-column-that-sums-values-while-keeping-the-values/m-p/596511#M207664 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/244559">@Newser703</a> </P><P>you can try eventstats  it should give you the output you are looking for</P><P> </P><P>| makeresults |eval Name="Name1",Type="TypeA",Value=2<BR />|append[|makeresults |eval Name="Name1",Type="TypeB",Value=4]<BR />|append[|makeresults |eval Name="Name1",Type="TypeC",Value=6]<BR />|append[|makeresults |eval Name="Name2",Type="TypeA",Value=4]<BR />|append[|makeresults |eval Name="Name2",Type="TypeB",Value=8]<BR />|append[|makeresults |eval Name="Name2",Type="TypeC",Value=3]<BR />|append[|makeresults |eval Name="Name3",Type="TypeA",Value=1]<BR />|append[|makeresults |eval Name="Name3",Type="TypeB",Value=5]<BR />|append[|makeresults |eval Name="Name3",Type="TypeC",Value=7]<BR />|eventstats sum(Value) AS SumbyName by Name |fields - _time</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="venky1544_0-1651756463723.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19444i2DE77623D037843E/image-size/medium?v=v2&px=400" role="button" title="venky1544_0-1651756463723.png" alt="venky1544_0-1651756463723.png" /></span></P><P> </P><P>If it helps karma is appreciated/if it resolves acceptance as solution is appreciated </P> Thu, 05 May 2022 13:14:36 GMT venky1544 2022-05-05T13:14:36Z How to add a column that sums values while keeping the values column https://community.splunk.com/t5/Splunk-Search/How-to-add-a-column-that-sums-values-while-keeping-the-values/m-p/596507#M207662 <P>Hello I have data that looks like this : </P><P> </P><LI-CODE lang="markup">Name | Type | Value ------------------------------------------ Name1 | TypeA | 2 Name1 | TypeB | 4 Name1 | TypeC | 6 Name2 | TypeA | 4 Name2 | TypeB | 8 Name2 | TypeC | 3 Name3 | TypeA | 1 Name3 | TypeB | 5 Name3 | TypeC | 7</LI-CODE><P> </P><P> Is it possible to add a column that sums the values by Name while keeping the Value column, like this : </P><P> </P><LI-CODE lang="markup">Name | Type | Value | SumByName --------------------------------------------------------- Name1 | TypeA | 2 | 12 Name1 | TypeB | 4 | 12 Name1 | TypeC | 6 | 12 Name2 | TypeA | 4 | 15 Name2 | TypeB | 8 | 15 Name2 | TypeC | 3 | 15 Name3 | TypeA | 1 | 13 Name3 | TypeB | 5 | 13 Name3 | TypeC | 7 | 13</LI-CODE><P> </P><P> Thanks for the help.</P> Thu, 05 May 2022 12:58:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-a-column-that-sums-values-while-keeping-the-values/m-p/596507#M207662 Newser703 2022-05-05T12:58:20Z Re: How to add a column that sums values while keeping the values column https://community.splunk.com/t5/Splunk-Search/How-to-add-a-column-that-sums-values-while-keeping-the-values/m-p/596511#M207664 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/244559">@Newser703</a> </P><P>you can try eventstats  it should give you the output you are looking for</P><P> </P><P>| makeresults |eval Name="Name1",Type="TypeA",Value=2<BR />|append[|makeresults |eval Name="Name1",Type="TypeB",Value=4]<BR />|append[|makeresults |eval Name="Name1",Type="TypeC",Value=6]<BR />|append[|makeresults |eval Name="Name2",Type="TypeA",Value=4]<BR />|append[|makeresults |eval Name="Name2",Type="TypeB",Value=8]<BR />|append[|makeresults |eval Name="Name2",Type="TypeC",Value=3]<BR />|append[|makeresults |eval Name="Name3",Type="TypeA",Value=1]<BR />|append[|makeresults |eval Name="Name3",Type="TypeB",Value=5]<BR />|append[|makeresults |eval Name="Name3",Type="TypeC",Value=7]<BR />|eventstats sum(Value) AS SumbyName by Name |fields - _time</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="venky1544_0-1651756463723.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/19444i2DE77623D037843E/image-size/medium?v=v2&px=400" role="button" title="venky1544_0-1651756463723.png" alt="venky1544_0-1651756463723.png" /></span></P><P> </P><P>If it helps karma is appreciated/if it resolves acceptance as solution is appreciated </P> Thu, 05 May 2022 13:14:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-add-a-column-that-sums-values-while-keeping-the-values/m-p/596511#M207664 venky1544 2022-05-05T13:14:36Z