https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303762#M91376 <P>Thanks for amazing explanation..!!</P> Sat, 20 May 2017 13:47:54 GMT gvnd 2017-05-20T13:47:54Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303757#M91371 <P>Hi my query is:<BR /> index=_internal earliest=-60m@m latest=now|transaction method | table root method status bytes | nomv bytes</P> <P>result for above query is:<BR /> <span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2971i8776A8F11374F2C4/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Here, I want to sum of all the values of "bytes" field . i.e single value of bytes field for each method.</P> <P>Thanks in advance</P> Fri, 19 May 2017 13:37:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303757#M91371 gvnd 2017-05-19T13:37:05Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303758#M91372 <P>Switch from transaction to <STRONG>stats</STRONG>. Add sourcetype/source to your query if it is applicable. _internal index contains a lot of Splunk's sourcetypes for internal purpose.</P> <PRE><CODE>index=_internal sourcetype=* earliest=-60m latest=now | stats values(root) as root values(status) as status sum(bytes) as bytes by method </CODE></PRE> <HR /> <P>updated to remove count as you dont seem to require eventcount or duration.</P> <P>PS: This is not a use case for transaction and stats should perform better in this case.</P> Fri, 19 May 2017 14:49:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303758#M91372 niketn 2017-05-19T14:49:54Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303759#M91373 <P>using eventstats:</P> <PRE><CODE> index = _internal | transaction method | table root method status bytes | eventstats sum(bytes) as Total_Bytes_by_Transaction | fields - bytes </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2970i1C564383AC3842C6/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 19 May 2017 14:56:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303759#M91373 adonio 2017-05-19T14:56:04Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303760#M91374 <P>You need a unique field for each transaction in order for eventstats to give you a by-transaction sum of the bytes. If you want the total bytes associated with each transaction, then you can do this...</P> <PRE><CODE>index=_internal earliest=-60m@m latest=now | transaction method | table root method status bytes | streamstats count as tranno | eventstats sum(bytes) as totalbytes by tranno </CODE></PRE> <P>...then, only if you want to retain the byte details for some reason... </P> <PRE><CODE>| nomv bytes </CODE></PRE> <P>... or if not </P> <PRE><CODE>| field - bytes </CODE></PRE> Fri, 19 May 2017 15:20:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303760#M91374 DalJeanis 2017-05-19T15:20:52Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303761#M91375 <P>thank you for that!</P> Fri, 19 May 2017 15:30:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303761#M91375 adonio 2017-05-19T15:30:56Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303762#M91376 <P>Thanks for amazing explanation..!!</P> Sat, 20 May 2017 13:47:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303762#M91376 gvnd 2017-05-20T13:47:54Z https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303763#M91377 <P>This works, but I found out that you have to use <EM>mvlist=t</EM> option in <EM>transaction</EM>, otherwise, repeated values in the mv field are not accounted for. i.e.,</P> <PRE><CODE>index=_internal earliest=-60m@m latest=now | transaction mvlist=t method | table root method status bytes | streamstats count as tranno | eventstats sum(bytes) as totalbytes by tranno </CODE></PRE> Sat, 02 Dec 2017 06:52:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-sum-the-values-of-a-multivalue-field/m-p/303763#M91377 tedwroks 2017-12-02T06:52:28Z