Splunk Search

Adding up numerical values within a multi-value field

hexx
Splunk Employee
Splunk Employee

In search language, is there a way to add the values stored in a multi-value field provided they are all numerical values?

I assume this might be possible with a rather excessive use of the eval functions, but I haven't been able to come up with something satisfactory.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

No it is not. The search language is intended for handling multiple events. Multivalued fields should not be overused. The way to add up values is really the have them properly normalized out in separate events/results:

sourcetype=x | stats list(x) as xlist, first(_serial) as _serial by y 
| eval eventuniquekey=_serial 
| mvexpand _serial 
| eventstats sum(xlist) as xsum by _serial,y 
| mvcombine xsum 
| fields - eventuniquekey,xlist

In this, y doesn't matter, it's just a placeholder for other potential split-by fields.

View solution in original post

Jordan_Brough
Path Finder

It's not hard to write your own custom search command that provides this functionality (or anything else you might want to do with multi-valued fields). Sometimes that just really comes in handy. Here's one I wrote: http://jordan.broughs.net/archives/2012/06/mvsum-for-splunk-summing-multi-valued-fields-within-a-sin...

gkanapathy
Splunk Employee
Splunk Employee

No it is not. The search language is intended for handling multiple events. Multivalued fields should not be overused. The way to add up values is really the have them properly normalized out in separate events/results:

sourcetype=x | stats list(x) as xlist, first(_serial) as _serial by y 
| eval eventuniquekey=_serial 
| mvexpand _serial 
| eventstats sum(xlist) as xsum by _serial,y 
| mvcombine xsum 
| fields - eventuniquekey,xlist

In this, y doesn't matter, it's just a placeholder for other potential split-by fields.

hexx
Splunk Employee
Splunk Employee

Thanks Gerald, your answer confirms what I thought.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...