Splunk Search

Adding up numerical values within a multi-value field

hexx
Splunk Employee
Splunk Employee

In search language, is there a way to add the values stored in a multi-value field provided they are all numerical values?

I assume this might be possible with a rather excessive use of the eval functions, but I haven't been able to come up with something satisfactory.

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

No it is not. The search language is intended for handling multiple events. Multivalued fields should not be overused. The way to add up values is really the have them properly normalized out in separate events/results:

sourcetype=x | stats list(x) as xlist, first(_serial) as _serial by y 
| eval eventuniquekey=_serial 
| mvexpand _serial 
| eventstats sum(xlist) as xsum by _serial,y 
| mvcombine xsum 
| fields - eventuniquekey,xlist

In this, y doesn't matter, it's just a placeholder for other potential split-by fields.

View solution in original post

Jordan_Brough
Path Finder

It's not hard to write your own custom search command that provides this functionality (or anything else you might want to do with multi-valued fields). Sometimes that just really comes in handy. Here's one I wrote: http://jordan.broughs.net/archives/2012/06/mvsum-for-splunk-summing-multi-valued-fields-within-a-sin...

gkanapathy
Splunk Employee
Splunk Employee

No it is not. The search language is intended for handling multiple events. Multivalued fields should not be overused. The way to add up values is really the have them properly normalized out in separate events/results:

sourcetype=x | stats list(x) as xlist, first(_serial) as _serial by y 
| eval eventuniquekey=_serial 
| mvexpand _serial 
| eventstats sum(xlist) as xsum by _serial,y 
| mvcombine xsum 
| fields - eventuniquekey,xlist

In this, y doesn't matter, it's just a placeholder for other potential split-by fields.

hexx
Splunk Employee
Splunk Employee

Thanks Gerald, your answer confirms what I thought.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...