How do I sum up all values on one line to give a max count ?

[luckyman80]

Hi Splunk!

Would someone be able to help me with following?

How do I sum up all values on one line to give a max count ?

count: 0 0 0 0 0 0 0 0 0 0 3890 24759 30388 3468 8 5079 6680 4410 6167 838 739 178 1 16 1]

Thanks so much

[cpetterborg]

The following "run-anywhere" search shows what you can do with rex, and event stats:

| makeresults
| eval data="count: 0 0 0 0 0 0 0 0 0 0 3890 24759 30388 3468 8 5079 6680 4410 6167 838 739 178 1 16 1]"
| rex field=data max_match=0 " (?<val>\d+)"
| eventstats sum(val) as total

This should give you what you want if your data is as your example shows.

[cpetterborg]

The first two lines from the above search are just setting up the data that YOU provided in your question. The last two lines are using THAT data to produce the results that you want. You have to ADAPT the search to YOUR instance, it is not a complete solution, but you only provided a fraction of what was needed for a complete solution.

[renjith_nair · Accepted solution]

@luckyman80,
Assuming its a sample event given and the digits are not separate fields, then give this a try

|rex field=_raw "count:\s(?<COUNTS>\d+\s.*[^\]])"
|eval COUNTS=split(COUNTS," ")|stats sum(COUNTS) as SUM by "one/more of your unique identifier of the event"

[luckyman80]

Hi Renjith thanks for your reply. I tried this on the following

FullRunLatency

freq (%): 0 0 0 0 0 0 0 0 0 0 0.1 18.9 15.8 1.8 <0.1 12.6 11.4 2.8 22.9 6.6 1.3 4.0 0.8 0.2 0.1 <0.1 <0.1

count: 0 0 0 0 0 0 0 0 0 0 136 17365 14542 1699 35 11592 10494 2589 21078 6059 1256 3693 806 238 104 67 8]

but unfortunately did not work .

[renjith_nair]

@luckyman80, so the event starts with freq (%) and not count ? Then you need to replace count with freq(%) in the above search. Also what are thoese "<" symbols ? Do you need to consider those as well?

In between @cpetterborg 's answer below is the better one - but you might need to replace count with freq(%) there as well

[luckyman80]

sorry I think I confused things... I only care about the count line but was showing that there was an additional identifier above (FullRunLatency ) I ran you rex againsnt the above but it doesn't pull out the line correctly. I checked the other example from cpetterborg but that's actually using the numbers from the logs when of course they will be different every time .

Thanks Guys..nearly there

[luckyman80]

Additional the error I get is Error in 'rex' command: Invalid argument: '2.'

[renjith_nair]

@luckyman80,try @cpetterborg answer below. Use only below part in your search and accept his answer if it helped you.

| rex field=data max_match=0 " (?<val>\d+)"
 | eventstats sum(val) as total

[Sukisen1981]

|addtotals ???