Splunk Search

## Combine the Sum of Two Fields

Path Finder

Hi all,

For a search similar to the following:
index=myindex "Search Term" NOT field=value source="mylog.log" | eval totalx=aCount+bCount | stats sum(totalx) by y | sort -sum(totalx)

Splunk returns exactly the data I am looking for. A table of sum(totalx) by y (of which there are around 5 different values of y). I have a request to combine the sum(totalx) values for 2 of the 5 values and treat them as one value but leave the rest unchanged. What would be the best way to accomplish this?

For instance, right now my search returns a table similar to this:
y sum(totalx)
1 10
2 20
3 30
4 40
5 50

I am essentially trying to create an additional field, let's call it 45, which represents the sum of 4 and 5 at all times. So instead, the data being visualized is:
y sum(totalx)
1 10
2 20
3 30
45 90

Thanks!

Tags (3)
SplunkTrust

Combine 4 and 5 before calling `stats`.

``````index=myindex "Search Term" NOT field=value source="mylog.log"
| eval totalx=aCount+bCount, y=case(y=4 OR y=5, 45, 1==1, y)
| stats sum(totalx) by y | sort -sum(totalx)
``````
---
If this reply helps you, Karma would be appreciated.
Path Finder

Hmm, this doesn't seem to do anything. Although I think it doesn't work because if I don't do stats I don't get the numerical values to combine. Stats is what causes the totalx by y to become available. Before I run stats y is just a text field=value pair that is non numerical if that makes sense?

SplunkTrust

Field y must exist before `stats` or you'll get no results.
The `case` function in my answer is doing the combining. It doesn't need numeric values (if you have nonnumeric values, use quotation marks `(y="d" OR y="e", "de")`). It produces data like this:

``````1 10
2 20
3 30
45 40
45 50
``````

Then `stats` can do the sums to produce

``````1 10
2 20
3 30
45 90
``````
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

#### Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

#### Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

#### Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...