topic Re: Adding up numerical values within a multi-value field in Splunk Search

Adding up numerical values within a multi-value field

hexx — Tue, 13 Jul 2010 07:52:23 GMT

In search language, is there a way to add the values stored in a multi-value field provided they are all numerical values?

I assume this might be possible with a rather excessive use of the eval functions, but I haven't been able to come up with something satisfactory.

Re: Adding up numerical values within a multi-value field

gkanapathy — Tue, 13 Jul 2010 10:38:10 GMT

No it is not. The search language is intended for handling multiple events. Multivalued fields should not be overused. The way to add up values is really the have them properly normalized out in separate events/results:

sourcetype=x | stats list(x) as xlist, first(_serial) as _serial by y 
| eval eventuniquekey=_serial 
| mvexpand _serial 
| eventstats sum(xlist) as xsum by _serial,y 
| mvcombine xsum 
| fields - eventuniquekey,xlist

In this, y doesn't matter, it's just a placeholder for other potential split-by fields.

Re: Adding up numerical values within a multi-value field

hexx — Wed, 14 Jul 2010 01:14:40 GMT

Thanks Gerald, your answer confirms what I thought.

Re: Adding up numerical values within a multi-value field

Jordan_Brough — Fri, 29 Jun 2012 15:22:01 GMT

It's not hard to write your own custom search command that provides this functionality (or anything else you might want to do with multi-valued fields). Sometimes that just really comes in handy. Here's one I wrote: http://jordan.broughs.net/archives/2012/06/mvsum-for-splunk-summing-multi-valued-fields-within-a-single-event