Splunk Search

How do I sum like fields from like events and show results?

tchampagne
New Member

I have a search that extracts the events and fields that I want. I want to sum the fields in like events. Here is a sample of the data that I have:
Events | Field1 | Field2
-------------------------------------
event1 | 6 | 2
event2 | 3 | 1
event1 | 2 | 4
event2 | 1 | 2
event2 | 5 | 2
event3 | 8 | 3

I would like to end up with the following:
Events | Field1 | Field2
-------------------------------------
event1 | 8 | 6
event2 | 9 | 5
event3 | 8 | 3

Is this possible? Any clues?

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this

<your search> | stats sum(Field1) as Sum1, sum(Field2) as Sum2 by Events | table Events Sum1 Sum2
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this

<your search> | stats sum(Field1) as Sum1, sum(Field2) as Sum2 by Events | table Events Sum1 Sum2
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...