Adding up numerical values within a multi-value field

[hexx]

In search language, is there a way to add the values stored in a multi-value field provided they are all numerical values?

I assume this might be possible with a rather excessive use of the eval functions, but I haven't been able to come up with something satisfactory.

[Jordan_Brough]

It's not hard to write your own custom search command that provides this functionality (or anything else you might want to do with multi-valued fields). Sometimes that just really comes in handy. Here's one I wrote: http://jordan.broughs.net/archives/2012/06/mvsum-for-splunk-summing-multi-valued-fields-within-a-sin...

[gkanapathy · Accepted solution]

No it is not. The search language is intended for handling multiple events. Multivalued fields should not be overused. The way to add up values is really the have them properly normalized out in separate events/results:

sourcetype=x | stats list(x) as xlist, first(_serial) as _serial by y 
| eval eventuniquekey=_serial 
| mvexpand _serial 
| eventstats sum(xlist) as xsum by _serial,y 
| mvcombine xsum 
| fields - eventuniquekey,xlist

In this, y doesn't matter, it's just a placeholder for other potential split-by fields.

[hexx]

Thanks Gerald, your answer confirms what I thought.