Archive

Sum of different fields for all events

New Member

Hi, I am trying to use Splunk to create dashboards based on different calculations of fields in a static CSV file. The content looks like:
alt text

I am trying to evaluate the sum of fields using:
source="biz_Case_test_3.csv" | eval total_benefit = "Automated Test Coverage" + "Feature Delivery“
but the visualization or stats tabs don't show any values. Can you please suggest how to fix this to calculate sum for various Year (event) fields. I am relatively new to Splunk and tried to look for answers on this but couldn't find anything to make it work.
Will appreciate any help

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

I have a suspicion the commas are getting in the way of things. I don't KNOW if his is the case because it looks like you pasted a screenshot of Excel in here (which is fine, just doesn't tell me if Splunk sees those fields with commas or without).

Best solution is to save the CSV without commas in it. It looks like your search should work after that.

A way to test this? We can use rex in sed mode to remove the commas and see what happens then.

source="biz_Case_test_3.csv" 
| rex mode=sed field="Automated Test Coverage" "s/,//g"
| rex mode=sed field="Feature Delivery" "s/,//g"
| eval total_benefit = "Automated Test Coverage" + "Feature Delivery“

If that works OK, then we know it's the problem. The best solution is to resave the CSV and re-ingest it without commas, but the above could be used in a pinch. There is way to automate removing commas during the input/parsing phase to make this happen on that incoming data if you can't save the data without commas initially, but easier if we don't have to.

So the rex will look for what's between the first two / characters, and substitute what's between the second two globally.
s substitute
/,/ whenever you see a comma, replace it with
// nothing ( = empty)
g globally, which just means don't stop after the first replacement in one string but keep doing them all.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

I have a suspicion the commas are getting in the way of things. I don't KNOW if his is the case because it looks like you pasted a screenshot of Excel in here (which is fine, just doesn't tell me if Splunk sees those fields with commas or without).

Best solution is to save the CSV without commas in it. It looks like your search should work after that.

A way to test this? We can use rex in sed mode to remove the commas and see what happens then.

source="biz_Case_test_3.csv" 
| rex mode=sed field="Automated Test Coverage" "s/,//g"
| rex mode=sed field="Feature Delivery" "s/,//g"
| eval total_benefit = "Automated Test Coverage" + "Feature Delivery“

If that works OK, then we know it's the problem. The best solution is to resave the CSV and re-ingest it without commas, but the above could be used in a pinch. There is way to automate removing commas during the input/parsing phase to make this happen on that incoming data if you can't save the data without commas initially, but easier if we don't have to.

So the rex will look for what's between the first two / characters, and substitute what's between the second two globally.
s substitute
/,/ whenever you see a comma, replace it with
// nothing ( = empty)
g globally, which just means don't stop after the first replacement in one string but keep doing them all.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!