Splunk Search

Adding up numerical values within a multi-value field

hexx
Splunk Employee
Splunk Employee

In search language, is there a way to add the values stored in a multi-value field provided they are all numerical values?

I assume this might be possible with a rather excessive use of the eval functions, but I haven't been able to come up with something satisfactory.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

No it is not. The search language is intended for handling multiple events. Multivalued fields should not be overused. The way to add up values is really the have them properly normalized out in separate events/results:

sourcetype=x | stats list(x) as xlist, first(_serial) as _serial by y 
| eval eventuniquekey=_serial 
| mvexpand _serial 
| eventstats sum(xlist) as xsum by _serial,y 
| mvcombine xsum 
| fields - eventuniquekey,xlist

In this, y doesn't matter, it's just a placeholder for other potential split-by fields.

View solution in original post

Jordan_Brough
Path Finder

It's not hard to write your own custom search command that provides this functionality (or anything else you might want to do with multi-valued fields). Sometimes that just really comes in handy. Here's one I wrote: http://jordan.broughs.net/archives/2012/06/mvsum-for-splunk-summing-multi-valued-fields-within-a-sin...

gkanapathy
Splunk Employee
Splunk Employee

No it is not. The search language is intended for handling multiple events. Multivalued fields should not be overused. The way to add up values is really the have them properly normalized out in separate events/results:

sourcetype=x | stats list(x) as xlist, first(_serial) as _serial by y 
| eval eventuniquekey=_serial 
| mvexpand _serial 
| eventstats sum(xlist) as xsum by _serial,y 
| mvcombine xsum 
| fields - eventuniquekey,xlist

In this, y doesn't matter, it's just a placeholder for other potential split-by fields.

View solution in original post

hexx
Splunk Employee
Splunk Employee

Thanks Gerald, your answer confirms what I thought.

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!