topic Need to add the numeric value after split in Splunk Search

Need to add the numeric value after split

AdixitSplunk — Thu, 29 Dec 2016 08:44:48 GMT

HI All,

I have a log like below,there are under Message field in the logs :
ApplicationName date. total: 2.This is the count: 35
ApplicationName date. total: 3.This is the count: 39

which is giving below result as expected:
num num1
35 2
39 3

what i want is Sum :
num num1
35 2
39 3
Total 74 5
I have tried : query|addcolstotal num num1 and stats sum(num) by host etc...but they are just not working .

Thanks in advance

Re: Need to add the numeric value after split

cmerriman — Thu, 29 Dec 2016 13:21:57 GMT

Try adding tonumber.

index=xyz sourcetype=abc|eval field=split(Message,":")|eval num=tonumber(mvindex(field,2))|eval field2=split(mvindex(field,1),".")|eval num1=tonumber(mvindex(field2,0))|table num num1

Re: Need to add the numeric value after split

somesoni2 — Thu, 29 Dec 2016 14:55:20 GMT

Give this a try

index=xyz sourcetype=abc 
| rex field=Message "total:\s*(?<num1>\d+).+count:\s*(?<num2>\d+)"
| table num1 num2
| addcoltotals

Re: Need to add the numeric value after split

AdixitSplunk — Fri, 30 Dec 2016 06:52:07 GMT

Thank you ..... It really helped