Splunk Search

Combining fields with mvcombine

jravida
Communicator

Hi folks,

I'm trying to merge events that share a common keyword value, with the mvcombine. The problem is it just lists the same value multiple times; I want it to add them up.

The search is relatively normal, but cumbersome to put here, so I will post just a bit:

... | table HOST percentcomplete | mvcombine percentcomplete | sort HOST

It combines the fields but outputs them as:

exch-svr-04 1.45
1.45
1.45
1.45
1.45
1.45
1.45
1.45
exch-svr-54 2.54
2.54
2.54
2.54
2.54
2.54

I want it to just add up those columns. Is there a simple way to do this?

Edit: I looked at some more results and it looks like my implementation of the mvcombine is also mergin my hosts. So I may be going about this the wrong way.

Tags (2)
0 Karma

wpreston
Motivator

How about

... | stats sum(percentcomplete) by HOST | sort HOST

instead of

... | table HOST percentcomplete | mvcombine percentcomplete | sort HOST
Get Updates on the Splunk Community!

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...

Use ‘em or lose ‘em | Splunk training units do expire

Whether it’s hummus, a ham sandwich, or a human, almost everything in this world has an expiration date. And, ...