https://community.splunk.com/t5/Splunk-Search/Extracting-fields-from-logs/m-p/94322#M24308 <PRE><CODE>... | rex "^(?:\S+\s){7}(?&lt;myfield&gt;\d+)" | accum myfield AS myfield_sum </CODE></PRE> Fri, 16 Mar 2012 13:29:45 GMT Ayn 2012-03-16T13:29:45Z https://community.splunk.com/t5/Splunk-Search/Extracting-fields-from-logs/m-p/94321#M24307 <P>I have a log file with below content</P> <P>20120316.051652 Fr I perf Thread-9807784[10.xx.xx.x]/xxxxxx xxxxxxx xxxxxxx 725 100 787234600 2107768832</P> <P>20120316.051652 Fr I perf Thread-9807750[10.xx.xx.x]/xxxxxxx xxxxxxx xxxxxxx 921 100 790443496 2107768832</P> <P>How can i add the values that are present in 9 th column of line example in the above line<BR /> i want to add 725 + 921 and print the sum of it.</P> Fri, 16 Mar 2012 12:37:15 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-fields-from-logs/m-p/94321#M24307 kandulasrinivas 2012-03-16T12:37:15Z https://community.splunk.com/t5/Splunk-Search/Extracting-fields-from-logs/m-p/94322#M24308 <PRE><CODE>... | rex "^(?:\S+\s){7}(?&lt;myfield&gt;\d+)" | accum myfield AS myfield_sum </CODE></PRE> Fri, 16 Mar 2012 13:29:45 GMT https://community.splunk.com/t5/Splunk-Search/Extracting-fields-from-logs/m-p/94322#M24308 Ayn 2012-03-16T13:29:45Z