topic Re: Count values from fields that may not exist in Splunk Search

Count values from fields that may not exist

Rialf1959 — Fri, 27 Oct 2017 11:26:19 GMT

Hello,
How to sums values from fields that may not exists? I want to sums fields (if exists ) with this pattern: networks.^[a-zA-Z0-9]*$.rx_bytes

For example:

    index=myindex sourcetype=mysourcetype| eval count=('networks.eth0.rx_bytes' + 'networks.eth1.rx_bytes' + 'networks.eth2.rx_bytes' + 'networks.eth(n).rx_bytes' )

Thanks

Re: Count values from fields that may not exist

richgalloway — Fri, 27 Oct 2017 12:58:32 GMT

Try this. The foreach command accepts wildcards, but not regular expressions.

index=myindex sourcetype=mysourcetype | eval count=0 | foreach network.*.rx_bytes [eval count=count+<<FIELD>>] | table count

If you need to be specific about field matching, try this query.

index=myindex sourcetype=mysourcetype | eval count=0 | foreach network.*.rx_bytes [eval count=if(match(<<FIELD>>,"networks.^[a-zA-Z0-9]*$.rx_bytes"),count+<<FIELD>>, count)] | table count

Re: Count values from fields that may not exist

HiroshiSatoh — Fri, 27 Oct 2017 13:03:41 GMT

Try this!

... | addtotals fieldname=count network.*.rx_bytes

Re: Count values from fields that may not exist

Rialf1959 — Mon, 30 Oct 2017 07:39:37 GMT

Does not work.
Sample data:
https://pastebin.com/9sRs35Z3

EDIT: ofcourse, there is typo in field name. Network vs Networks

Re: Count values from fields that may not exist

Rialf1959 — Mon, 30 Oct 2017 07:39:43 GMT

Does not work.
Sample data:
https://pastebin.com/9sRs35Z3

EDIT: ofcourse, there is typo in field name. Network vs Networks