topic Re: Need help with a splunk search in Splunk Search

How to add value in two fields based on their name?

phularah — Fri, 27 Jan 2023 21:33:29 GMT

Hi, I would like to add value in two fields based on their name. I want the output as sum of traffic_in#fw1+traffic_out#fw1 and so on by _time.

Re: Need help with a splunk search

gcusello — Fri, 27 Jan 2023 16:03:48 GMT

HI @phularah,

did you tried with addtotals command (https://splunkonbigdata.com/usage-of-splunk-commands-addtotals/)?

Ciao.

Giuseppe

Re: Need help with a splunk search

phularah — Sun, 29 Jan 2023 05:15:26 GMT

Hi, @gcusello,

addtotals would add all the field values, which I don't want.

I want the sum of the fields in such a way that it only adds up the fw values, like traffic_infw1+traffic_outfw1, traffic_infw2+traffic_outw2, traffic_infw3+traffic_outfw3 and so on. Now, fw can change and so do their numbers.

So, if I have 10 fields initially, I should get 5 fields after the summation of required field values. and after that timechart would show 5 graphical lines.

Like in the screenshot shared in the question, I would want sum of field values of 1st and 5th field, 2nd and 6th, 3rd and 7th and 4th and 8th fields.

Re: How to add value in two fields based on their name?

yuanliu — Sun, 29 Jan 2023 06:52:18 GMT

Something like this?

| foreach traffic_*#* [eval "in_and_out#<<MATCHSEG2>>" = 'traffic_in#<<MATCHSEG2>>' + 'traffic_out#<<MATCHSEG2>>']

Re: Need help with a splunk search

gcusello — Sun, 29 Jan 2023 08:09:25 GMT

Hi @phularah ,

if the field names are fixed, you can use eval to sum some selected values.

Ciao.

Giuseppe

Re: How to add value in two fields based on their name?

phularah — Sun, 29 Jan 2023 08:24:13 GMT

Yes, that's exactly what I wanted.