Splunk Search

Count values from fields that may not exist

Rialf1959
Explorer

Hello,
How to sums values from fields that may not exists? I want to sums fields (if exists ) with this pattern: networks.^[a-zA-Z0-9]*$.rx_bytes

For example:

    index=myindex sourcetype=mysourcetype| eval count=('networks.eth0.rx_bytes' + 'networks.eth1.rx_bytes' + 'networks.eth2.rx_bytes' + 'networks.eth(n).rx_bytes' )

Thanks

0 Karma

HiroshiSatoh
Champion

Try this!

... | addtotals fieldname=count network.*.rx_bytes

Rialf1959
Explorer

Does not work.
Sample data:
https://pastebin.com/9sRs35Z3

EDIT: ofcourse, there is typo in field name. Network vs Networks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this. The foreach command accepts wildcards, but not regular expressions.

index=myindex sourcetype=mysourcetype | eval count=0 | foreach network.*.rx_bytes [eval count=count+<<FIELD>>] | table count

If you need to be specific about field matching, try this query.

index=myindex sourcetype=mysourcetype | eval count=0 | foreach network.*.rx_bytes [eval count=if(match(<<FIELD>>,"networks.^[a-zA-Z0-9]*$.rx_bytes"),count+<<FIELD>>, count)] | table count
---
If this reply helps you, an upvote would be appreciated.

Rialf1959
Explorer

Does not work.
Sample data:
https://pastebin.com/9sRs35Z3

EDIT: ofcourse, there is typo in field name. Network vs Networks

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.