Dashboards & Visualizations

How to iterate multivalue filed and get sum of values

user9025
Path Finder

I have a splunk log as :

 

 

Client Map Details : {A=123, B=245, C=456}

 

 

The Map can contain more values apart from these 3, or less values, may be 0 to 10 enteries.

I want to get sum of all the values of map and plot in graph, for eg, for above 123+245+456=X, then I need to plot X on graph.

 I am able to get the multivalue field as:

 

 

index=temp  sourcetype="xyz" "Client Map Details : " | rex field=_raw "Client Map Details \{(?<map>[A-Z_0-9= ,]+)\}" | eval temp=split(map,",")

 

Output from above is 

A=123
 B=245
 C=456

 

Now how can I iterate over each value from temp and then split by "=" and get value of each? Or is there a better way to do this?

Also how do i plot graph for this?

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\{(?<details>[^\}]+)\}"
| rex max_match=0 field=details "\w+=(?<value>\d+)"
| eventstats sum(value) as sum by _raw

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "\{(?<details>[^\}]+)\}"
| rex max_match=0 field=details "\w+=(?<value>\d+)"
| eventstats sum(value) as sum by _raw
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...