https://community.splunk.com/t5/Splunk-Search/Sum-of-the-field-based-on-the-other-field-values/m-p/678707#M232060 <P>Here is one of perhaps many ways to do that.&nbsp; It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.</P><LI-CODE lang="markup">| rex field=ROW1 "(?&lt;ROW1&gt;.)" | stats sum(ROWcount) as ROWcount by ROW1</LI-CODE> Mon, 26 Feb 2024 18:35:30 GMT richgalloway 2024-02-26T18:35:30Z https://community.splunk.com/t5/Splunk-Search/Sum-of-the-field-based-on-the-other-field-values/m-p/678705#M232059 <P>Hi Team,<BR /><BR />how to Sum of the field based on the other field values.<BR />Row1 field values will be 0-9 and a-z.<BR />Sample one given below:</P><TABLE border="0" width="128" cellspacing="0" cellpadding="0"><TBODY><TR><TD width="64" height="19">ROW1</TD><TD width="64">ROWcount</TD></TR><TR><TD height="19">11</TD><TD>22</TD></TR><TR><TD height="19">12</TD><TD>54</TD></TR><TR><TD height="19">13</TD><TD>34</TD></TR><TR><TD height="19">a1</TD><TD>56</TD></TR><TR><TD height="19">a2</TD><TD>78</TD></TR><TR><TD height="19">d3</TD><TD>67</TD></TR><TR><TD height="19">c4</TD><TD>78</TD></TR><TR><TD height="19">c5</TD><TD>79</TD></TR></TBODY></TABLE><P><BR />Final Output be like:</P><TABLE border="0" width="128" cellspacing="0" cellpadding="0"><TBODY><TR><TD width="56.9375px" height="14px">ROW1</TD><TD width="88.4375px" height="14px">ROWcount</TD></TR><TR><TD width="56.9375px" height="14px">1</TD><TD width="88.4375px" height="14px">110</TD></TR><TR><TD width="56.9375px" height="14px">a</TD><TD width="88.4375px" height="14px">134</TD></TR><TR><TD width="56.9375px" height="14px">d</TD><TD width="88.4375px" height="14px">67</TD></TR><TR><TD width="56.9375px" height="14px">c</TD><TD width="88.4375px" height="14px">157</TD></TR></TBODY></TABLE><P><BR />Thanks in Advance!!</P> Mon, 26 Feb 2024 18:28:09 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-the-field-based-on-the-other-field-values/m-p/678705#M232059 Anud 2024-02-26T18:28:09Z https://community.splunk.com/t5/Splunk-Search/Sum-of-the-field-based-on-the-other-field-values/m-p/678707#M232060 <P>Here is one of perhaps many ways to do that.&nbsp; It extracts the first letter of ROW1 as the new ROW1 value and the adds the ROWcount values with matching ROW1 values.</P><LI-CODE lang="markup">| rex field=ROW1 "(?&lt;ROW1&gt;.)" | stats sum(ROWcount) as ROWcount by ROW1</LI-CODE> Mon, 26 Feb 2024 18:35:30 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-the-field-based-on-the-other-field-values/m-p/678707#M232060 richgalloway 2024-02-26T18:35:30Z https://community.splunk.com/t5/Splunk-Search/Sum-of-the-field-based-on-the-other-field-values/m-p/678787#M232090 <P>Logic was worked. Thank you&nbsp; so much&nbsp;</P> Tue, 27 Feb 2024 09:05:39 GMT https://community.splunk.com/t5/Splunk-Search/Sum-of-the-field-based-on-the-other-field-values/m-p/678787#M232090 Anud 2024-02-27T09:05:39Z