Splunk Search

How do I get the sum of values for non-unique fields?

cabbageel
New Member

Hi.

I have 4 events with field smsresult= , and I have to sum the values of this field. I tried to use

stats sum(SMSRESULT) 

The problem is that some events are absolutely same and Splunk ignores repeated values.
For example sum of

... smsresult=9
... smsresult=9
... smsresult=1
... smsresult=9

returns me not 28, but 10.

What I have to do to fix this?

0 Karma

somesoni2
Revered Legend

Can you provide your full search that you're using?

0 Karma

rfaircloth_splu
Splunk Employee
Splunk Employee

In the example given is smsresult= a multiple kv field within the same event?

Try
* | mvexpand smsresult | stats sum(smsresult)

0 Karma

somesoni2
Revered Legend

Stats sum will work fine (as intended) without mvexpand as well. see this runanywhere sample

| gentimes start=-1 | eval temp="1,3,3,3" | makemv temp delim="," | stats sum(temp) list(temp)

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...